Splunk Search

Why does appendcols with search post-process fail?

twinspop
Influencer

I've got a search defined in a simple dashboard:

<search id="jenkins_search">
  <query>index=scm sourcetype=jenkins_test_summary test summary| head 1</query>
</search>

And I reference that search further down in the panels. In one of them:

<search base="jenkins_search">
  <query>stats last(failures) as Failures by tests</query>
</search>

That works. But if I modify this to include an appendcols command:

<search base="jenkins_search">
  <query>stats last(failures) as Failures by tests | appendcols [search index=test | stats count as TOTAL | fields TOTAL]</query>
</search>

The panel fails with the error: "Error in appendcols command: You can only use appendcols after a reporting command (such as stats, chart or timechart)."

REALLY curious... if I click the magnifying glass, bottom left of the panel, to open in search, the entire search works as intended.

Am I missing something, or is this a bug with the postProcess feature? Running on Splunk Enterprise 6.2.4 Linux 64-bit.

Thanks,
Jon

1 Solution

bmacias84
Champion

Only the base search actually runs the search job. The reference search act as filter and/ or modifiers of the original data. The base search should include all data need in post process search, because they will not initiate a search job.

View solution in original post

bmacias84
Champion

Only the base search actually runs the search job. The reference search act as filter and/ or modifiers of the original data. The base search should include all data need in post process search, because they will not initiate a search job.

Get Updates on the Splunk Community!

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...