I have a query, the definition of appendcols is as below.
"Appends the fields of the subsearch results with the input search results."
If input search does not fetch anything(zero events) what happens to the fields of sub search? How they are appended then? Do we get missing graph in visualization?
Everything is given in this doc :
well your question is quite general appendcols appends fields of the subsearch results with the input search results.
Even if your main search does not produce any results your subsearch will append to new column.
You can try this by taking dummy events/data:
| makeresults | eval data="" | appendcols [search index=_internal | dedup log_level | table log_level ]
Just a NOTE :
You can only use appendcols after a reporting command (such as stats, chart, or timechart).
let me know if this helps!
ya still the output is same:
index=si | timechart count | appendcols [search index=_internal | dedup log_level | table log_level ]
The main search will give you
no results as there is no