Issue with appendcols

[edschembor]

So, I have the following code which searches for two types of errors and creates a bar graph showing how many times each one occurs. Very simple.

index=hpov eph " error " AND (tag="EPH_SVR") | eval ReasonForFailure="" | chart count as error by ReasonForFailure |  appendcols [search index=hpov eph " exception " AND (tag="EPH_SVR")| stats count as exception] |  appendcols [search index=hpov eph " EXCEPTION " AND (tag="EPH_SVR") | stats count as exception]

However, when I click on the second bar so I can see which events it consists of, the search instead brings up that of the first bar. I'm not sure why this is occurring. Is the "eval" somehow linking them??

Thanks!!!

[somesoni2 · Accepted solution]

Can you try with construct?

|multisearch [search index=hpov eph " error " AND (tag="EPH_SVR") | eval Type="Error" ] [search index=hpov eph " exception " AND (tag="EPH_SVR")| eval Type="exception"] [search index=hpov eph " EXCEPTION " AND (tag="EPH_SVR") |eval Type="EXCEPTION"] | chart count by Type

2nd Update:

index=hpov eph " error " AND (tag="EPH_SVR") | eval Type="Error" | eval counter=1 | appendpipe [|stats count | eval counter=0 | eval Type="Error"| where count=0] | append [search index=hpov eph " exception " AND (tag="EPH_SVR")| eval Type="exception"|eval counter=1| appendpipe[|stats count | eval counter=0 | eval Type="exception"| where count=0]] | append [search index=hpov eph " EXCEPTION " AND (tag="EPH_SVR") |eval Type="EXCEPTION"|eval counter=1| appendpipe[|stats count | eval counter=0|eval Type="EXCEPTION"| where count=0]] | chart sum(counter) as count by Type

[somesoni2]

Anything I add for showing zero-count results is causing drilldown to fail (default drilldown). This one shows zero-count results and drilldown works too, but in the output bar chart, you need to 'stack' the bars.

index=hpov eph  AND (tag="EPH_SVR") (" error " OR  " exception " OR " EXCEPTION "  | eval test=1| eval Type=case(like(_raw,"% error %"),"Error",like(_raw,"% exception %"),"exception",like(_raw,"% EXCEPTION %"),"EXCEPTION") | stats count(eval(Type="Error")) as CountError count(eval(Type="exception")) as CountWarning count(eval(Type="EXCEPTION")) as CountInfo by Type

[edschembor]

Still the same. If I click on the exception bar, it brings up events with errors, not exceptions

[somesoni2]

Try the 2nd Update.

[edschembor]

The update didn't actually fix anything. If I click on the exception bar on the graph, it does a search and shows events with errors, not with exceptions. It still only searches for the first search. Without the update was better

[edschembor]

Yes thank you!! However, is there a way to still show non-zero results and the item categories on the side like it would with appendcol?