Splunk Search

Append do not work anymore

telecomdesign
New Member

Hello

I did a code using append it was working perfectly. I didn't use my code for a week and now it is not working anymore.
Have you ever seen that before ?

my code:
index="my-index"

|append [search (type="repair_event" test_station="test1" )
OR (type="status_event" descriptor_name="test1" )
| stats distinct_count(serial) as r, distinct_count(number) as q by work_order | eval percent_err= round((q/r)*100,100) | eval percent_ok1=(100.00-percent_err)
]

|append [search (type="repair_event" test_station="test2" ) OR (type="status_event" descriptor_name="test2" )
| stats distinct_count(serial) as r, distinct_count(number) as q by work_order | eval percent_err= round((q/r)*100,100) | eval percent_ok4=(100.00-percent_err)
]

| stats first(percent_ok1),first(percent_ok4) by work_order

Thanks for your help

Tags (2)
0 Karma

broberg
Communicator

Are you in the same app as you were previously when it worked?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

What do you mean by "not working"? What results are you getting now compared to what you were getting a week ago?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Classroom Chronicles: Training Tales and Testimonials (Episode 4)

Welcome back to Splunk Classroom Chronicles, our ongoing series where we shine a light on what really happens ...

From GPU to Application: Monitoring Cisco AI Infrastructure with Splunk Observability ...

AI workloads are different. They demand specialized infrastructure—powerful GPUs, enterprise-grade networking, ...

Application management with Targeted Application Install for Victoria Experience

  Experience a new era of flexibility in managing your Splunk Cloud Platform apps! With Targeted Application ...