Splunk Search

Why does appendcols with search post-process fail?

twinspop
Influencer

I've got a search defined in a simple dashboard:

<search id="jenkins_search">
  <query>index=scm sourcetype=jenkins_test_summary test summary| head 1</query>
</search>

And I reference that search further down in the panels. In one of them:

<search base="jenkins_search">
  <query>stats last(failures) as Failures by tests</query>
</search>

That works. But if I modify this to include an appendcols command:

<search base="jenkins_search">
  <query>stats last(failures) as Failures by tests | appendcols [search index=test | stats count as TOTAL | fields TOTAL]</query>
</search>

The panel fails with the error: "Error in appendcols command: You can only use appendcols after a reporting command (such as stats, chart or timechart)."

REALLY curious... if I click the magnifying glass, bottom left of the panel, to open in search, the entire search works as intended.

Am I missing something, or is this a bug with the postProcess feature? Running on Splunk Enterprise 6.2.4 Linux 64-bit.

Thanks,
Jon

1 Solution

bmacias84
Champion

Only the base search actually runs the search job. The reference search act as filter and/ or modifiers of the original data. The base search should include all data need in post process search, because they will not initiate a search job.

View solution in original post

bmacias84
Champion

Only the base search actually runs the search job. The reference search act as filter and/ or modifiers of the original data. The base search should include all data need in post process search, because they will not initiate a search job.

Get Updates on the Splunk Community!

App Platform's 2025 Year in Review: A Year of Innovation, Growth, and Community

As we step into 2026, it’s the perfect moment to reflect on what an extraordinary year 2025 was for the Splunk ...

Operationalizing Entity Risk Score with Enterprise Security 8.3+

Overview Enterprise Security 8.3 introduces a powerful new feature called “Entity Risk Scoring” (ERS) for ...

Unlock Database Monitoring with Splunk Observability Cloud

  In today’s fast-paced digital landscape, even minor database slowdowns can disrupt user experiences and ...