All Apps and Add-ons

Issue with appendcols

edschembor
Path Finder

So, I have the following code which searches for two types of errors and creates a bar graph showing how many times each one occurs. Very simple.

index=hpov eph " error " AND (tag="EPH_SVR") | eval ReasonForFailure="" | chart count as error by ReasonForFailure |  appendcols [search index=hpov eph " exception " AND (tag="EPH_SVR")| stats count as exception] |  appendcols [search index=hpov eph " EXCEPTION " AND (tag="EPH_SVR") | stats count as exception]

However, when I click on the second bar so I can see which events it consists of, the search instead brings up that of the first bar. I'm not sure why this is occurring. Is the "eval" somehow linking them??

Thanks!!!

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Can you try with construct?

|multisearch [search index=hpov eph " error " AND (tag="EPH_SVR") | eval Type="Error" ] [search index=hpov eph " exception " AND (tag="EPH_SVR")| eval Type="exception"] [search index=hpov eph " EXCEPTION " AND (tag="EPH_SVR") |eval Type="EXCEPTION"] | chart count by Type

2nd Update:

index=hpov eph " error " AND (tag="EPH_SVR") | eval Type="Error" | eval counter=1 | appendpipe [|stats count | eval counter=0 | eval Type="Error"| where count=0] | append [search index=hpov eph " exception " AND (tag="EPH_SVR")| eval Type="exception"|eval counter=1| appendpipe[|stats count | eval counter=0 | eval Type="exception"| where count=0]] | append [search index=hpov eph " EXCEPTION " AND (tag="EPH_SVR") |eval Type="EXCEPTION"|eval counter=1| appendpipe[|stats count | eval counter=0|eval Type="EXCEPTION"| where count=0]] | chart sum(counter) as count by Type

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Can you try with construct?

|multisearch [search index=hpov eph " error " AND (tag="EPH_SVR") | eval Type="Error" ] [search index=hpov eph " exception " AND (tag="EPH_SVR")| eval Type="exception"] [search index=hpov eph " EXCEPTION " AND (tag="EPH_SVR") |eval Type="EXCEPTION"] | chart count by Type

2nd Update:

index=hpov eph " error " AND (tag="EPH_SVR") | eval Type="Error" | eval counter=1 | appendpipe [|stats count | eval counter=0 | eval Type="Error"| where count=0] | append [search index=hpov eph " exception " AND (tag="EPH_SVR")| eval Type="exception"|eval counter=1| appendpipe[|stats count | eval counter=0 | eval Type="exception"| where count=0]] | append [search index=hpov eph " EXCEPTION " AND (tag="EPH_SVR") |eval Type="EXCEPTION"|eval counter=1| appendpipe[|stats count | eval counter=0|eval Type="EXCEPTION"| where count=0]] | chart sum(counter) as count by Type

somesoni2
SplunkTrust
SplunkTrust

Anything I add for showing zero-count results is causing drilldown to fail (default drilldown). This one shows zero-count results and drilldown works too, but in the output bar chart, you need to 'stack' the bars.

index=hpov eph  AND (tag="EPH_SVR") (" error " OR  " exception " OR " EXCEPTION "  | eval test=1| eval Type=case(like(_raw,"% error %"),"Error",like(_raw,"% exception %"),"exception",like(_raw,"% EXCEPTION %"),"EXCEPTION") | stats count(eval(Type="Error")) as CountError count(eval(Type="exception")) as CountWarning count(eval(Type="EXCEPTION")) as CountInfo by Type
0 Karma

edschembor
Path Finder

Still the same. If I click on the exception bar, it brings up events with errors, not exceptions

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try the 2nd Update.

0 Karma

edschembor
Path Finder

The update didn't actually fix anything. If I click on the exception bar on the graph, it does a search and shows events with errors, not with exceptions. It still only searches for the first search. Without the update was better

0 Karma

edschembor
Path Finder

Yes thank you!! However, is there a way to still show non-zero results and the item categories on the side like it would with appendcol?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...