Dashboards & Visualizations

How to edit my appencols search?

sidekix24
Path Finder

I'm having issues with this panel when using appendcols. Here's the search:

index="ai.snv.mon.query.25" ScanTime!="ScanTime" Product=an OR Product=s4 OR Product=buyer Filename="*is_up_on_*" Status="crit" | stats dc(Filename) AS Database by Product | appendcols[search index="ai.snv.mon.query.25" ScanTime!="ScanTime" Product=an OR Product=s4 OR Product=buyer Filename="*buyer_integrated_realms_front_door.query" OR Filename="*s4_integrated_realms_front_door.query"  | eval Nstatus=if(Status== "info", 0, 1) | stats dc(Filename) AS iFrontdoors by Product] | appendcols [search index="ai.snv.mon.query.25" ScanTime!="ScanTime" Product=an OR Product=s4 OR Product=buyer DataBlob="*uiHint: General*" Status="crit" | stats dc(Filename) AS Frontdoors by Product ] | table Product Frontdoors iFrontdoors Database

and here's the table that comes out:

alt text

The issue is that the "1" in iFrontdoors for "an" should be in the cell for "s4" and the an/ifrontdoor cell should be blank. Everything else lines up correctly. I've tried re-ordering the searches but that doesn't fix the issue. By process of elimination, when I take out the search for "iFrontdoors" the numbers line up correctly.

Anyone have any suggestions?

Thanks

0 Karma

niketn
Legend

If the issue is with the following query run the same in Verbose mode and validate the extracted Product field whether it is s4 or an. As per the stats I expect it to be an.

index="ai.snv.mon.query.25" ScanTime!="ScanTime" Product=an OR Product=s4 OR Product=buyer Filename="*buyer_integrated_realms_front_door.query" OR Filename="*s4_integrated_realms_front_door.query" | eval Nstatus=if(Status== "info", 0, 1) | stats dc(Filename) AS iFrontdoors by Product

PS: Seems like Nstats field is not used.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

sidekix24
Path Finder

Running that search in Verbose mode brings back the correct product and count

alt text

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...