Dashboards & Visualizations

Why can't we drill down when using appendcols

xvxt006
Contributor

Hi, i am not able to drill down and i get a message "PARSER: Applying intentions failed Unable to drilldown because of post-reporting 'appendcols' command". Is there any workaround for this?

Tags (1)
0 Karma

jtrucks
Splunk Employee
Splunk Employee

IIRC, the final search results when using appendcols (or other subsearch methods), the only results you see from the final results viewpoint is the output of the subsearch (appendcols) command. More specifically, it works like this:

  1. search starts, gets some data
  2. appendcols (or other subsearch) command then happens
  3. appendcols (other subsearch) completes and outputs the results back to the original search as input
  4. original search finishes or pipes to subsequent commands

So, thinking of this process, the output of the appendcols (subsearch) command(s) is a limited set of data. The search it performed is not preserved in this process; only the output is preserved. Therefore, you cannot drill down because you are already at the most original format of data from the final result perspective.

To work around this problem you could push subsearch results to a summary index or use scheduled searches that store the data that you can then later drill into without performing the original search again from the beginning.

--
Jesse Trucks
Minister of Magic

jtrucks
Splunk Employee
Splunk Employee

You are welcome! Please mark as answered if you feel it was!

--
Jesse Trucks
Minister of Magic
0 Karma

xvxt006
Contributor

Thank you for the suggestions and explanation. jtrucks.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...