- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
why can't I get 7 days of data in appendcols search?
Hi All,
I have a search for comparing data between 2 weeks, I can get data for 7 days in first search, but only got 2 days data in appendcols search, why can't I get 7 days of data in appendcols search?
index=xxx earliest=-7d@d latest=-0d@d | eval Date1 = (date_year + "-" + date_month + "-" + date_mday)
| stats count AS SearchThisWeek by Date1
| appendcols [ search index=xxx earliest=-14d@d latest=-10d@d | eval Date2 = (date_year + "-" + date_month + "-" + date_mday) | stats count AS SearchLastWeek by Date2]
| eval SearchFluctuatePerc=(SearchThisWeek-SearchLastWeek)/ SearchLastWeek
| fields Date1, SearchThisWeek, Date2, SearchLastWeek, SearchFluctuatePerc
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I found a solution for this, just need to set the maxtime
and timeout
| appendcols maxtime=600 timeout=600
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

The appendcols
is a subsearch
which is limited to 50.5K results returned to the main search. When I need to do something like this, I search for the broadest range (in this case earliest=-14d@d latest=-0d@d
and then preclude the stuff that I don't need with _time>foo AND time<bar
where you calcluate foo
and bar
with a subsearch and relative_time
.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi woodcock,
Do you have an example for this kind of search?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

I’d you do it without the date evals, does it work?
If so use strftime on _time to format it.
Like this
| eval Date2=strftime(_time,”%Y-%m-%d”)
The date_mday etc are not reliable for statistical functions.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi, I tried using strftime on _time and still see the same issue.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

I think that it is because data does not exist.
Does the sub search result for 7 days?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi HiroshiSatoh,
I tried the sub search and could get results for 7 days(2018/6/15—2018/6/21).
Thanks,
Min
