Need help on appendcols _time issue

[jip31]

hello

When I run the search below, its gives me "4" in results at the _time span = 11h

`index`  earliest=@d+7h latest=@d+19h 
| bin _time span=1h 
 | stats dc(sign_id) as "Signal inc" by _time

But

`index` earliest=@d+7h latest=@d+19h 
| stats avg(citrix) as citrix by sam _time 
| eval PbPerf=if(citrix>200,1,0) 
| search PbPerf > 0 
| bin _time span=1h 
| stats dc(sam) as "W" by _time 
| appendcols 
    [ search `index` earliest=@d+7h latest=@d+19h 
    | bin _time span=1h 
    | stats count as W by _time] 
| appendcols 
    [ search `index` earliest=@d+7h latest=@d+19h 
    | bin _time span=1h 
    | stats dc(signaler_id) as "Signal inc" by _time ] 
| appendcols 
    [ search `index` earliest=@d+7h latest=@d+19h 
    | bin _time span=1h 
    | stats count as "TEA" by _time] 
| fillnull value=0 
| eval time=strftime(_time,"%H:%M") 
| sort time 
| fields - _time _span _origtime 
| transpose 0 header_field=time column_name=KPI 
| sort + KPI

 my problem is that I must use this search with other search in order to display results by _time span

So when I execute this search with other searches, the results for th primary search is always 4 but it's display the _time span = 11h but for the _time span= 8h!!!

whats is the problem please? 

[ITWhisperer · Accepted solution]

As you know, appendcols does not correlate the values in the rows, it just adds data rows in the order returned i.e. the first row returned will be added to the first row of the current set, this means the results can get out of line. Try using timechart which will generate the "missing" time periods.

`index` earliest=@d+7h latest=@d+19h 
| stats avg(citrix) as citrix by sam _time 
| eval PbPerf=if(citrix>200,1,0) 
| search PbPerf > 0 
| timechart span=1h dc(sam) as "W"
| appendcols 
    [ search `index` earliest=@d+7h latest=@d+19h 
    | timechart span=1h count as W] 
| appendcols 
    [ search `index` earliest=@d+7h latest=@d+19h 
    | timechart span=1h dc(signaler_id) as "Signal inc" ] 
| appendcols 
    [ search `index` earliest=@d+7h latest=@d+19h 
    | timechart span=1h count as "TEA"] 
| fillnull value=0 
| eval time=strftime(_time,"%H:%M") 
| sort time 
| fields - _time _span _origtime 
| transpose 0 header_field=time column_name=KPI 
| sort + KPI