Reporting

Why is appendcols no longer working in some scheduled searches in Splunk 6.2?

moataz_gaber
New Member

After upgrade to splunk 6.2 some scheduled PDF are not working ... received the below error
Error in 'appendcols' command: You can only use appendcols after a reporting command (such as stats, chart, or timechart).
Here is my original search
eventtype="general_testcases" | timechart span=1mon dc(user) as "Total"
| appendcols maxtime=600 [search eventtype="test_case_1" | timechart span=1mon dc(user) as "Test1"]
| appendcols maxtime=600 [search eventtype="test_case_2" | timechart span=1mon dc(user) as "Test2"]

I don't know why it is not working anymore ... Please help ASAP

0 Karma

rsimmons
Splunk Employee
Splunk Employee

Splunk is currently aware of this error and its a known issue (SPL-93020), where the error appears to be coming from the AppendProcessor which is extracting it from the search.log. Currently there is no workaround, however the issue will be
addressed in an upcoming release.

Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...