Splunk Search

In appendcols if input search does not fetch anything what happens to the fields of sub search?

Explorer

Hi,

I have a query, the definition of appendcols is as below.

"Appends the fields of the subsearch results with the input search results."

If input search does not fetch anything(zero events) what happens to the fields of sub search? How they are appended then? Do we get missing graph in visualization?

Please explain.

0 Karma

SplunkTrust
SplunkTrust

Hi

Everything is given in this doc :
https://docs.splunk.com/Documentation/Splunk/7.2.1/SearchReference/Appendcols

well your question is quite general appendcols appends fields of the subsearch results with the input search results.
Even if your main search does not produce any results your subsearch will append to new column.

You can try this by taking dummy events/data:

| makeresults 
|  eval data=""
|  appendcols 
    [search index=_internal 
    | dedup log_level 
    |  table log_level
    ]

Just a NOTE : You can only use appendcols after a reporting command (such as stats, chart, or timechart).
let me know if this helps!

0 Karma

Explorer

In the above example you have created an event with field having null value. My question is if it does not return any event, then?

0 Karma

SplunkTrust
SplunkTrust

ya still the output is same:

try this:

index=si 
| timechart count 
|   appendcols 
     [search index=_internal 
     | dedup log_level 
     |  table log_level
     ]

The main search will give you no results as there is no si index.

0 Karma