Why can't we drill down when using appendcols

[xvxt006]

Hi, i am not able to drill down and i get a message "PARSER: Applying intentions failed Unable to drilldown because of post-reporting 'appendcols' command". Is there any workaround for this?

[jtrucks]

IIRC, the final search results when using appendcols (or other subsearch methods), the only results you see from the final results viewpoint is the output of the subsearch (appendcols) command. More specifically, it works like this:

1. search starts, gets some data
2. appendcols (or other subsearch) command then happens
3. appendcols (other subsearch) completes and outputs the results back to the original search as input
4. original search finishes or pipes to subsequent commands

So, thinking of this process, the output of the appendcols (subsearch) command(s) is a limited set of data. The search it performed is not preserved in this process; only the output is preserved. Therefore, you cannot drill down because you are already at the most original format of data from the final result perspective.

To work around this problem you could push subsearch results to a summary index or use scheduled searches that store the data that you can then later drill into without performing the original search again from the beginning.

[jtrucks]

You are welcome! Please mark as answered if you feel it was!

[xvxt006]

Thank you for the suggestions and explanation. jtrucks.