In appendcols if input search does not fetch anything what happens to the fields of sub search?

[zeespl]

Hi,

I have a query, the definition of appendcols is as below.

"Appends the fields of the subsearch results with the input search results."

If input search does not fetch anything(zero events) what happens to the fields of sub search? How they are appended then? Do we get missing graph in visualization?

Please explain.

[mayurr98]

Hi

Everything is given in this doc :
https://docs.splunk.com/Documentation/Splunk/7.2.1/SearchReference/Appendcols

well your question is quite general appendcols appends fields of the subsearch results with the input search results.
Even if your main search does not produce any results your subsearch will append to new column.

You can try this by taking dummy events/data:

| makeresults 
|  eval data=""
|  appendcols 
    [search index=_internal 
    | dedup log_level 
    |  table log_level
    ]

Just a NOTE : You can only use appendcols after a reporting command (such as stats, chart, or timechart).
let me know if this helps!

[zeespl]

In the above example you have created an event with field having null value. My question is if it does not return any event, then?

[mayurr98]

ya still the output is same:

try this:

index=si 
| timechart count 
|   appendcols 
     [search index=_internal 
     | dedup log_level 
     |  table log_level
     ]

The main search will give you no results as there is no si index.