topic Why can't we drill down when using appendcols in Dashboards & Visualizations

Why can't we drill down when using appendcols

xvxt006 — Sun, 02 Jun 2013 18:42:40 GMT

Hi, i am not able to drill down and i get a message "PARSER: Applying intentions failed Unable to drilldown because of post-reporting 'appendcols' command". Is there any workaround for this?

Re: Why can't we drill down when using appendcols

jtrucks — Mon, 03 Jun 2013 19:57:59 GMT

IIRC, the final search results when using appendcols (or other subsearch methods), the only results you see from the final results viewpoint is the output of the subsearch (appendcols) command. More specifically, it works like this:

search starts, gets some data
appendcols (or other subsearch) command then happens
appendcols (other subsearch) completes and outputs the results back to the original search as input
original search finishes or pipes to subsequent commands

So, thinking of this process, the output of the appendcols (subsearch) command(s) is a limited set of data. The search it performed is not preserved in this process; only the output is preserved. Therefore, you cannot drill down because you are already at the most original format of data from the final result perspective.

To work around this problem you could push subsearch results to a summary index or use scheduled searches that store the data that you can then later drill into without performing the original search again from the beginning.

Re: Why can't we drill down when using appendcols

xvxt006 — Mon, 03 Jun 2013 20:45:39 GMT

Thank you for the suggestions and explanation. jtrucks.

Re: Why can't we drill down when using appendcols

jtrucks — Mon, 03 Jun 2013 20:55:13 GMT

You are welcome! Please mark as answered if you feel it was!