Appendpipe alters field values when not null

[ebs]

Hi,

I'm inserting an appendpipe into my SPL so that in the event there are no results, a stats table will still be produced.

However, I am seeing differences in the field values when they are not null. Can anyone explain why this is occurring and how to fix this?

[kamlesh_vaghela]

@ebs 

Well if you want to display the Tier for which the events are not available OR has no count, I think append pipe or append column will not help you.

But as you are doing  transpose and fields in you further searches I would like to suggest you below search.

YOUR_DATAMODEL_SEARCH 
| stats count as averageResponse by Tier
| eval averageResponse=round(averageResponse,3)
| transpose 0 header_field="Tier"
| eval _time=now()
| fields unaithenticated,highPriority,lowPrioriy,unattended,largePayload _time
| fillnull value=0.000 unaithenticated,highPriority,lowPrioriy,unattended,largePayload

My Sample Search :

| makeresults | eval Tier="unaithenticated,highPriority,lowPrioriy",Tier=split(Tier,",") | stats count as averageResponse by Tier
| eval averageResponse=round(averageResponse,3)
| transpose 0 header_field="Tier"
| eval _time=now()
| fields unaithenticated,highPriority,lowPrioriy,unattended,largePayload _time
| fillnull value=0.000 unaithenticated,highPriority,lowPrioriy,unattended,largePayload

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

[kamlesh_vaghela]

@ebs 

have you tried appendcols ?

[ebs]

Using appendcols, there are still differences

lowPriority, unattended, and largePayload still differ from the values when not using an appendcol/appendpipe

[ebs]

SPL results when there is no appendpipe