Appendcols Error

[TiagoTLD1]

Hi,

I have a dashboard and a saved search is referenced into a simple xml search:

  <search id="StatusChart" ref="ESB_StatusCharts">
    <latest>$Drilldown_Picker.latest$</latest>
    <earliest>$Drilldown_Picker.earliest$</earliest>
  </search>

I use this as a base search for another query, like this,

<search id="rootchart" base="StatusChart">
<query>
      | timechart blablabla |appendcols [ | inputlookup Thresholds.csv ] ..........
</query>

I have this error:" Error in 'appendcols' command: You can only use appendcols after a reporting command (such as stats, chart, or timechart)."

Which doesn't make any sense, the timechart is right before it. Furthermore, if I take the savedsearch code and put it explicitly in the simple xml code, it works fine....

Anyone?

Thanks

[joshualarkins]

Ugh, I just ran into this too. Works fine as long as you don't use a base search in a dashboard.

[cjj1977]

I am guessing that this is a bug, as per the comment by @woodcock above.

I had this problem in Spunk 6.5.1 for a gauge visualization. I was using a base search (as per the original question above). When I removed the base search and added the full search in-line on that panel the gauge worked.

I tried tweaking both the base search (e.g. explicitly choosing the columns with the fields command) and changing the syntax of the stats command (e.g. by adding--in my case--a logically unnecessary "BY" clause). Nothing worked.

I guess another workaround could be to use append with a dummy field:

<main_search>
| stats count
| eval dummy=1
| append [| <second_search> | stats count AS total | eval dummy=1 ]
| stats max(count) AS count, max(total) AS total BY results
| eval percentage = round(count / total * 100, 2)
| table percentage

[cjj1977]

I have this same problem in Splunk 6.5.1. It seems to have started when I changed a dashboard panel to use a base search rather than an inline search. When I click the magnifying glass on this panel and run the search it works correctly.

The logic in this search is to calculate one single value (users who did X), then calculate a maximum possible value (all possible users) and calculate a percentage for a gauge visualization.

[niketn]

@Tiago. I am hoping you have Threshold computed in the lookup file for the same duration/span being plotted through timechart on your base search.

Can you please try join instead of appendcols. Make sure the only the field required to be correlated is present in your base query/timechart from your saved search and also in the sub-search from the lookup file.

 <search id="rootchart" base="StatusChart">
 <query>
       | timechart blablabla 
       | join 
               [ | inputlookup Thresholds.csv ] ..........
 </query>

PS: You can also check appendpipe or append which should work as opposed to appendcols, however, might not fit your need.

[woodcock]

This looks like a bug; I would open a support ticket.

[somesoni2]

What you do get from the lookup table, a single row/column?

[TiagoTLD1]

A row with 6 columns