Splunk Search

Why does appendcols with search post-process fail?

twinspop
Influencer

I've got a search defined in a simple dashboard:

<search id="jenkins_search">
  <query>index=scm sourcetype=jenkins_test_summary test summary| head 1</query>
</search>

And I reference that search further down in the panels. In one of them:

<search base="jenkins_search">
  <query>stats last(failures) as Failures by tests</query>
</search>

That works. But if I modify this to include an appendcols command:

<search base="jenkins_search">
  <query>stats last(failures) as Failures by tests | appendcols [search index=test | stats count as TOTAL | fields TOTAL]</query>
</search>

The panel fails with the error: "Error in appendcols command: You can only use appendcols after a reporting command (such as stats, chart or timechart)."

REALLY curious... if I click the magnifying glass, bottom left of the panel, to open in search, the entire search works as intended.

Am I missing something, or is this a bug with the postProcess feature? Running on Splunk Enterprise 6.2.4 Linux 64-bit.

Thanks,
Jon

1 Solution

bmacias84
Champion

Only the base search actually runs the search job. The reference search act as filter and/ or modifiers of the original data. The base search should include all data need in post process search, because they will not initiate a search job.

View solution in original post

bmacias84
Champion

Only the base search actually runs the search job. The reference search act as filter and/ or modifiers of the original data. The base search should include all data need in post process search, because they will not initiate a search job.

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Think Like an Architect: Introducing the Splunk Certified Cybersecurity Defense ...

In cybersecurity, defenders respond to threats. Architects design the systems that stop them.    As ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...