Why does appendcols produce the same result for two different searches?

[saradachelluboy]

The below search String works same for approved and decline. Can some let me know where the error is?

All the time it executes index="pg_int" sourcetype="pg" (responseCode=00) for approved and declined. Please help.

index="pg_int" sourcetype="pg"  (responseCode=00) | timechart count as approved | appendcols [search index="pg_int" sourcetype="pg"  (responseCode!=00)| timechart count as declined]

[sundareshr · Accepted solution]

For the appendcols to align correctly, try adding a span to your timechart. Something like this

index="pg_int" sourcetype="pg"  (responseCode=00) | timechart span=1d count as approved | appendcols [search index="pg_int" sourcetype="pg"  (responseCode!=00)| timechart span=1d count as declined]

Having said that, a faster approach may be this...

index="pg_int" sourcetype="pg"  responseCode=* | eval response_cd=if(responseCode="00", "approved" , "declined") | timechart span=1h count by response_cd

[saradachelluboy]

Thanks Sundar!!!

The faster approach worked fine but I wonder why the appendcols still didn't work after the changes.I am using Splunk 6.1 and IE11

[saradachelluboy]

Can you please help me how to restrict specific responseCode for decline?
responseCode =90 or responseCode = 08 consider as Decline.

[sundareshr]

Change the eval segment like this

.... | eval response_cd=case(responseCode="00", "approved", responseCode="90" OR responseCode="08", "declined", 1=1, "other")

The other for all other responseCodes. If you don't want to show that field, you can add this to the end of the query

| fields - other