How do I use appdncols command in order to aggregate in a table the result of different search?

[jip31]

hello

I use appdncols command in order to aggregate in a table the result of different search

I have 2 issues with the 3 fields In yellow

Issue 1

If dont use the piece of code below, the field "Tea" is not displayed (same thing for INC & OUT)

 | appendpipe 
        [ stats count as _events 
        | where _events = 0 
        | eval "Tea"= 0]]

Issue 2

the appendpipe command put only "0" in the first line but not in other

Here is the search :

| appendcols 
    [ search index=titi earliest=@d+7h latest=@d+19h 
    | bin span=1h _time 
    | eval time = strftime(_time, "%H:%M") 
    | stats dc(Tea) as Tea by time 
    | rename time as Heure 
    | appendpipe 
        [ stats count as _events 
        | where _events = 0 
        | eval Tea= 0] ] 
| appendcols 
    [ search index=tutu earliest=@d+7h latest=@d+19h 
    | bin span=1h _time 
    | eval time = strftime(_time, "%H:%M")  
    | stats dc(s) as "OUT" by time 
    | rename time as Heure 
    | appendpipe 
        [ stats count as _events 
        | where _events = 0 
        | eval "OUT"= 0]] 

What is wrong please?

And I have something else strange

As you can, the the results is 0, the results is ususally displayed

But why sometimes I have an empty field instaed 0 like in yellow?

Is anybody can give the solution for displaying the results in any case when the value is 0?

[ITWhisperer]

Try something like this

| fillnull value=0

[jip31]

when I execute the search outsite the appendcols

index=test earliest=@d+7h latest=@d+19h 
| bin span=1h _time 
| eval time = strftime(_time, "%H:%M") 
| fillnull value=0 
| stats dc(id) as id by time 
| rename time as Heure

here is the result

as you can see the first result is at 8:00

But when I execute the code in the gloabl search, the first is result is at 7h... (it's the last column on the right)

How is it possible to have 1h gap?

[ITWhisperer]

How is it possible to tell what is wrong if you don't provide the searches you are comparing?

By the way, the fillnull should be added at the end of the search which produced the second graphic.

[jip31]

Here is  the xml

https://www.cjoint.com/c/LCslTFsaF1Q

[ITWhisperer]

This isn't the XML!

[jip31]

I checked it and its the xml... what is your problem exactly?

https://www.cjoint.com/c/LCufzkXpwpg

Click on red buttons for download

You can see a piece of code where there is the problem

| appendcols 
    [ search `indexcs` sourcetype=sig earliest=@d+7h latest=@d+19h 
    | bin span=1h _time 
    | eval time = strftime(_time, "%H:%M") 
    | fillnull value=0 
    | stats dc(sig) as  "incidents" by time 
    | rename time as Heure ] 
| appendcols ....

[ITWhisperer]

fillnull value=0 needs to go at the very end (after the closing bracket of the last appendcols)

[jip31]

OK i am going to test

Just thing strange is that 0 is put automaticcally in some résults wihout fillnull =0 but for the exemple I sent you it seems that when result=0 there is nothing returnerd....

[jip31]

I have already tried, it does nOthing...

[ITWhisperer]

Can you share your full search with the fillnull included?

[jip31]

Have you an idea concerning this strange behavior?