Splunk Search

Why does appendcols with search post-process fail?

twinspop
Influencer

I've got a search defined in a simple dashboard:

<search id="jenkins_search">
  <query>index=scm sourcetype=jenkins_test_summary test summary| head 1</query>
</search>

And I reference that search further down in the panels. In one of them:

<search base="jenkins_search">
  <query>stats last(failures) as Failures by tests</query>
</search>

That works. But if I modify this to include an appendcols command:

<search base="jenkins_search">
  <query>stats last(failures) as Failures by tests | appendcols [search index=test | stats count as TOTAL | fields TOTAL]</query>
</search>

The panel fails with the error: "Error in appendcols command: You can only use appendcols after a reporting command (such as stats, chart or timechart)."

REALLY curious... if I click the magnifying glass, bottom left of the panel, to open in search, the entire search works as intended.

Am I missing something, or is this a bug with the postProcess feature? Running on Splunk Enterprise 6.2.4 Linux 64-bit.

Thanks,
Jon

1 Solution

bmacias84
Champion

Only the base search actually runs the search job. The reference search act as filter and/ or modifiers of the original data. The base search should include all data need in post process search, because they will not initiate a search job.

View solution in original post

bmacias84
Champion

Only the base search actually runs the search job. The reference search act as filter and/ or modifiers of the original data. The base search should include all data need in post process search, because they will not initiate a search job.

Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Laser Bananas and Edge Hubs: Exploring Operational Technology (OT) Data Through a ...

  OT is a different environment to traditional IT and can have interesting challenges when interfacing the ...

Event Series: Mastering AI Tokenomics and Splunk Agent Observability

Beyond the Black Box: Correlating AI Performance and Tokenomics with Splunk Agent Observability   As ...

span_metrics: The OpenTelemetry-Idiomatic Way to See Inside Your Services

You open a trace in Splunk Observability Cloud and everything looks fine. One root span, order-pipeline, with ...