All Apps and Add-ons

Issue with appendcols

Path Finder

So, I have the following code which searches for two types of errors and creates a bar graph showing how many times each one occurs. Very simple.

index=hpov eph " error " AND (tag="EPH_SVR") | eval ReasonForFailure="" | chart count as error by ReasonForFailure |  appendcols [search index=hpov eph " exception " AND (tag="EPH_SVR")| stats count as exception] |  appendcols [search index=hpov eph " EXCEPTION " AND (tag="EPH_SVR") | stats count as exception]

However, when I click on the second bar so I can see which events it consists of, the search instead brings up that of the first bar. I'm not sure why this is occurring. Is the "eval" somehow linking them??

Thanks!!!

0 Karma
1 Solution

Revered Legend

Can you try with construct?

|multisearch [search index=hpov eph " error " AND (tag="EPH_SVR") | eval Type="Error" ] [search index=hpov eph " exception " AND (tag="EPH_SVR")| eval Type="exception"] [search index=hpov eph " EXCEPTION " AND (tag="EPH_SVR") |eval Type="EXCEPTION"] | chart count by Type

2nd Update:

index=hpov eph " error " AND (tag="EPH_SVR") | eval Type="Error" | eval counter=1 | appendpipe [|stats count | eval counter=0 | eval Type="Error"| where count=0] | append [search index=hpov eph " exception " AND (tag="EPH_SVR")| eval Type="exception"|eval counter=1| appendpipe[|stats count | eval counter=0 | eval Type="exception"| where count=0]] | append [search index=hpov eph " EXCEPTION " AND (tag="EPH_SVR") |eval Type="EXCEPTION"|eval counter=1| appendpipe[|stats count | eval counter=0|eval Type="EXCEPTION"| where count=0]] | chart sum(counter) as count by Type

View solution in original post

Revered Legend

Can you try with construct?

|multisearch [search index=hpov eph " error " AND (tag="EPH_SVR") | eval Type="Error" ] [search index=hpov eph " exception " AND (tag="EPH_SVR")| eval Type="exception"] [search index=hpov eph " EXCEPTION " AND (tag="EPH_SVR") |eval Type="EXCEPTION"] | chart count by Type

2nd Update:

index=hpov eph " error " AND (tag="EPH_SVR") | eval Type="Error" | eval counter=1 | appendpipe [|stats count | eval counter=0 | eval Type="Error"| where count=0] | append [search index=hpov eph " exception " AND (tag="EPH_SVR")| eval Type="exception"|eval counter=1| appendpipe[|stats count | eval counter=0 | eval Type="exception"| where count=0]] | append [search index=hpov eph " EXCEPTION " AND (tag="EPH_SVR") |eval Type="EXCEPTION"|eval counter=1| appendpipe[|stats count | eval counter=0|eval Type="EXCEPTION"| where count=0]] | chart sum(counter) as count by Type

View solution in original post

Revered Legend

Anything I add for showing zero-count results is causing drilldown to fail (default drilldown). This one shows zero-count results and drilldown works too, but in the output bar chart, you need to 'stack' the bars.

index=hpov eph  AND (tag="EPH_SVR") (" error " OR  " exception " OR " EXCEPTION "  | eval test=1| eval Type=case(like(_raw,"% error %"),"Error",like(_raw,"% exception %"),"exception",like(_raw,"% EXCEPTION %"),"EXCEPTION") | stats count(eval(Type="Error")) as CountError count(eval(Type="exception")) as CountWarning count(eval(Type="EXCEPTION")) as CountInfo by Type
0 Karma

Path Finder

Still the same. If I click on the exception bar, it brings up events with errors, not exceptions

0 Karma

Revered Legend

Try the 2nd Update.

0 Karma

Path Finder

The update didn't actually fix anything. If I click on the exception bar on the graph, it does a search and shows events with errors, not with exceptions. It still only searches for the first search. Without the update was better

0 Karma

Path Finder

Yes thank you!! However, is there a way to still show non-zero results and the item categories on the side like it would with appendcol?

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!