https://community.splunk.com/t5/Splunk-Search/Help-understanding-appendpipe/m-p/541960#M153486 <P>Hi,</P><P>I didn't find anything about this while searching so here's my question.</P><P>I'm working on the proving a negative problem, adding appendpipe after a stats in order to display a result of 0 for each day for the period of time I need. I usually do this for a single row, however I need to have multiple rows for multiple days as output for stats or more importantly timechart.</P><P>I ran into a scenario I cannot explain and wanted to understand further. While testing I created this search:</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P><LI-CODE lang="markup">| makeresults | eval value=0, category="test", _time=strftime(now(), "%H") | appendpipe [| eval value=0, category="test", _time=relative_time(now(), "-1d@d") ] | appendpipe [| eval value=0, category="test", _time=relative_time(now(), "-2d@d")] | appendpipe [| eval value=0, category="test", _time=relative_time(now(), "-3d@d")] | appendpipe [| eval value=0, category="test", _time=relative_time(now(), "-4d@d")] | appendpipe [| eval value=0, category="test", _time=relative_time(now(), "-5d@d")] | appendpipe [| eval value=0, category="test", _time=relative_time(now(), "-6d@d")] | appendpipe [| eval value=0, category="test", _time=relative_time(now(), "-7d@d")] | appendpipe [| eval value=0, category="test", _time=relative_time(now(), "-8d@d")] | appendpipe [| eval value=0, category="test", _time=relative_time(now(), "-9d@d")] | stats count by _time</LI-CODE><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P><P>The results of this output 256 results for a single date/time, and others follow with smaller amounts but not counts of 1.</P><P>If I change it to this:</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P><LI-CODE lang="markup">| makeresults | eval value=0, category="test", _time=relative_time(now(), "-2d@d") | appendpipe [| eval value=0, category="test", _time=relative_time(now(), "-1d@d") | dedup value category _time] | appendpipe [| eval value=0, category="test", _time=relative_time(now(), "-2d@d") | dedup value category _time] | appendpipe [| eval value=0, category="test", _time=relative_time(now(), "-3d@d") | dedup value category _time] | appendpipe [| eval value=0, category="test", _time=relative_time(now(), "-4d@d") | dedup value category _time] | appendpipe [| eval value=0, category="test", _time=relative_time(now(), "-5d@d") | dedup value category _time] | appendpipe [| eval value=0, category="test", _time=relative_time(now(), "-6d@d") | dedup value category _time] | appendpipe [| eval value=0, category="test", _time=relative_time(now(), "-7d@d") | dedup value category _time] | appendpipe [| eval value=0, category="test", _time=relative_time(now(), "-8d@d") | dedup value category _time] | appendpipe [| eval value=0, category="test", _time=relative_time(now(), "-9d@d") | dedup value category _time] | stats count by _time</LI-CODE><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P><P>Every row has a single count except for one, which makes sense given how this is written. I can move forward with this, but now I would like to know why this happens.&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P> Tue, 02 Mar 2021 13:02:38 GMT chirsf 2021-03-02T13:02:38Z https://community.splunk.com/t5/Splunk-Search/Help-understanding-appendpipe/m-p/541960#M153486 <P>Hi,</P><P>I didn't find anything about this while searching so here's my question.</P><P>I'm working on the proving a negative problem, adding appendpipe after a stats in order to display a result of 0 for each day for the period of time I need. I usually do this for a single row, however I need to have multiple rows for multiple days as output for stats or more importantly timechart.</P><P>I ran into a scenario I cannot explain and wanted to understand further. While testing I created this search:</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P><LI-CODE lang="markup">| makeresults | eval value=0, category="test", _time=strftime(now(), "%H") | appendpipe [| eval value=0, category="test", _time=relative_time(now(), "-1d@d") ] | appendpipe [| eval value=0, category="test", _time=relative_time(now(), "-2d@d")] | appendpipe [| eval value=0, category="test", _time=relative_time(now(), "-3d@d")] | appendpipe [| eval value=0, category="test", _time=relative_time(now(), "-4d@d")] | appendpipe [| eval value=0, category="test", _time=relative_time(now(), "-5d@d")] | appendpipe [| eval value=0, category="test", _time=relative_time(now(), "-6d@d")] | appendpipe [| eval value=0, category="test", _time=relative_time(now(), "-7d@d")] | appendpipe [| eval value=0, category="test", _time=relative_time(now(), "-8d@d")] | appendpipe [| eval value=0, category="test", _time=relative_time(now(), "-9d@d")] | stats count by _time</LI-CODE><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P><P>The results of this output 256 results for a single date/time, and others follow with smaller amounts but not counts of 1.</P><P>If I change it to this:</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P><LI-CODE lang="markup">| makeresults | eval value=0, category="test", _time=relative_time(now(), "-2d@d") | appendpipe [| eval value=0, category="test", _time=relative_time(now(), "-1d@d") | dedup value category _time] | appendpipe [| eval value=0, category="test", _time=relative_time(now(), "-2d@d") | dedup value category _time] | appendpipe [| eval value=0, category="test", _time=relative_time(now(), "-3d@d") | dedup value category _time] | appendpipe [| eval value=0, category="test", _time=relative_time(now(), "-4d@d") | dedup value category _time] | appendpipe [| eval value=0, category="test", _time=relative_time(now(), "-5d@d") | dedup value category _time] | appendpipe [| eval value=0, category="test", _time=relative_time(now(), "-6d@d") | dedup value category _time] | appendpipe [| eval value=0, category="test", _time=relative_time(now(), "-7d@d") | dedup value category _time] | appendpipe [| eval value=0, category="test", _time=relative_time(now(), "-8d@d") | dedup value category _time] | appendpipe [| eval value=0, category="test", _time=relative_time(now(), "-9d@d") | dedup value category _time] | stats count by _time</LI-CODE><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P><P>Every row has a single count except for one, which makes sense given how this is written. I can move forward with this, but now I would like to know why this happens.&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P> Tue, 02 Mar 2021 13:02:38 GMT https://community.splunk.com/t5/Splunk-Search/Help-understanding-appendpipe/m-p/541960#M153486 chirsf 2021-03-02T13:02:38Z https://community.splunk.com/t5/Splunk-Search/Help-understanding-appendpipe/m-p/541964#M153489 <P>appendpipe is operating on each event in the pipeline, so the first appendpipe only has one event (the first you created with makeresults) to work with, and it appends a new event to the pipeline. The second appendpipe now has two events to work with, so it appends a new event for each event, making a total of 4. The third appendpipe doubles your events again, and so on.</P> Tue, 02 Mar 2021 13:34:43 GMT https://community.splunk.com/t5/Splunk-Search/Help-understanding-appendpipe/m-p/541964#M153489 ITWhisperer 2021-03-02T13:34:43Z https://community.splunk.com/t5/Splunk-Search/Help-understanding-appendpipe/m-p/541975#M153496 <P>Thanks, this makes total sense. I don't know if my solution here is the correct one, I mean it works so in that vein it's correct. However I feel like it's.. a hack lol.</P><P>&nbsp;</P> Tue, 02 Mar 2021 14:34:43 GMT https://community.splunk.com/t5/Splunk-Search/Help-understanding-appendpipe/m-p/541975#M153496 chirsf 2021-03-02T14:34:43Z https://community.splunk.com/t5/Splunk-Search/Help-understanding-appendpipe/m-p/541983#M153497 <P>Your approach is probably more hacky than others I have seen&nbsp;<span class="lia-unicode-emoji" title=":grinning_face:">😀</span>&nbsp;- you could use append with makeresults (append at the end of the pipeline rather than after each event), you could use union with makeresults, you could use makecontinuous over the time field (although you would need more than one event so append/makeresults or something similar would still be required). There are many ways to skin that cat.&nbsp;<span class="lia-unicode-emoji" title=":grinning_face:">😀</span></P> Tue, 02 Mar 2021 14:48:00 GMT https://community.splunk.com/t5/Splunk-Search/Help-understanding-appendpipe/m-p/541983#M153497 ITWhisperer 2021-03-02T14:48:00Z https://community.splunk.com/t5/Splunk-Search/Help-understanding-appendpipe/m-p/541985#M153498 <P>Yea I thought about using makecontinuous but I cannot guarantee even a single event will show up for the time range I'm looking for to use that, or I misunderstand how that works. Thanks for the leads on the other ideas i appreciate it.</P> Tue, 02 Mar 2021 14:54:20 GMT https://community.splunk.com/t5/Splunk-Search/Help-understanding-appendpipe/m-p/541985#M153498 chirsf 2021-03-02T14:54:20Z https://community.splunk.com/t5/Splunk-Search/Help-understanding-appendpipe/m-p/541997#M153508 <P>Thanks to mmcul on slack this is the answer I'm going with:</P><P>&nbsp;</P><LI-CODE lang="markup">| append [| gentimes start=-14 end=0 increment=1d | eval _time=starttime, category="test", value=0 | fields _time, category, value ]</LI-CODE> Tue, 02 Mar 2021 15:32:32 GMT https://community.splunk.com/t5/Splunk-Search/Help-understanding-appendpipe/m-p/541997#M153508 chirsf 2021-03-02T15:32:32Z