All Apps and Add-ons

Appendcols Error

TiagoTLD1
Communicator

Hi,

I have a dashboard and a saved search is referenced into a simple xml search:

  <search id="StatusChart" ref="ESB_StatusCharts">
    <latest>$Drilldown_Picker.latest$</latest>
    <earliest>$Drilldown_Picker.earliest$</earliest>
  </search>

I use this as a base search for another query, like this,

<search id="rootchart" base="StatusChart">
<query>
      | timechart blablabla |appendcols [ | inputlookup Thresholds.csv ] ..........
</query>

I have this error:" Error in 'appendcols' command: You can only use appendcols after a reporting command (such as stats, chart, or timechart)."

Which doesn't make any sense, the timechart is right before it. Furthermore, if I take the savedsearch code and put it explicitly in the simple xml code, it works fine....

Anyone?

Thanks

joshualarkins
Explorer

Ugh, I just ran into this too. Works fine as long as you don't use a base search in a dashboard.

0 Karma

cjj1977
Path Finder

I am guessing that this is a bug, as per the comment by @woodcock above.

I had this problem in Spunk 6.5.1 for a gauge visualization. I was using a base search (as per the original question above). When I removed the base search and added the full search in-line on that panel the gauge worked.

I tried tweaking both the base search (e.g. explicitly choosing the columns with the fields command) and changing the syntax of the stats command (e.g. by adding--in my case--a logically unnecessary "BY" clause). Nothing worked.

I guess another workaround could be to use append with a dummy field:

<main_search>
| stats count
| eval dummy=1
| append [| <second_search> | stats count AS total | eval dummy=1 ]
| stats max(count) AS count, max(total) AS total BY results
| eval percentage = round(count / total * 100, 2)
| table percentage

cjj1977
Path Finder

I have this same problem in Splunk 6.5.1. It seems to have started when I changed a dashboard panel to use a base search rather than an inline search. When I click the magnifying glass on this panel and run the search it works correctly.

The logic in this search is to calculate one single value (users who did X), then calculate a maximum possible value (all possible users) and calculate a percentage for a gauge visualization.

0 Karma

niketnilay
Legend

@Tiago. I am hoping you have Threshold computed in the lookup file for the same duration/span being plotted through timechart on your base search.

Can you please try join instead of appendcols. Make sure the only the field required to be correlated is present in your base query/timechart from your saved search and also in the sub-search from the lookup file.

 <search id="rootchart" base="StatusChart">
 <query>
       | timechart blablabla 
       | join 
               [ | inputlookup Thresholds.csv ] ..........
 </query>

PS: You can also check appendpipe or append which should work as opposed to appendcols, however, might not fit your need.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

woodcock
Esteemed Legend

This looks like a bug; I would open a support ticket.

0 Karma

somesoni2
Revered Legend

What you do get from the lookup table, a single row/column?

0 Karma

TiagoTLD1
Communicator

A row with 6 columns

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...