Why does appendcols with search post-process fail?

twinspop — Thu, 06 Aug 2015 17:31:07 GMT

I've got a search defined in a simple dashboard:

<search id="jenkins_search">
  <query>index=scm sourcetype=jenkins_test_summary test summary| head 1</query>
</search>

And I reference that search further down in the panels. In one of them:

<search base="jenkins_search">
  <query>stats last(failures) as Failures by tests</query>
</search>

That works. But if I modify this to include an appendcols command:

<search base="jenkins_search">
  <query>stats last(failures) as Failures by tests | appendcols [search index=test | stats count as TOTAL | fields TOTAL]</query>
</search>

The panel fails with the error: "Error in appendcols command: You can only use appendcols after a reporting command (such as stats, chart or timechart)."

REALLY curious... if I click the magnifying glass, bottom left of the panel, to open in search, the entire search works as intended.

Am I missing something, or is this a bug with the postProcess feature? Running on Splunk Enterprise 6.2.4 Linux 64-bit.

Thanks,
Jon

Re: Why does appendcols with search post-process fail?

bmacias84 — Thu, 06 Aug 2015 18:38:50 GMT

Only the base search actually runs the search job. The reference search act as filter and/ or modifiers of the original data. The base search should include all data need in post process search, because they will not initiate a search job.

topic Re: Why does appendcols with search post-process fail? in Splunk Search

Why does appendcols with search post-process fail?

Re: Why does appendcols with search post-process fail?