Splunk Search

In appendcols if input search does not fetch anything what happens to the fields of sub search?

zeespl
Explorer

Hi,

I have a query, the definition of appendcols is as below.

"Appends the fields of the subsearch results with the input search results."

If input search does not fetch anything(zero events) what happens to the fields of sub search? How they are appended then? Do we get missing graph in visualization?

Please explain.

0 Karma

mayurr98
Super Champion

Hi

Everything is given in this doc :
https://docs.splunk.com/Documentation/Splunk/7.2.1/SearchReference/Appendcols

well your question is quite general appendcols appends fields of the subsearch results with the input search results.
Even if your main search does not produce any results your subsearch will append to new column.

You can try this by taking dummy events/data:

| makeresults 
|  eval data=""
|  appendcols 
    [search index=_internal 
    | dedup log_level 
    |  table log_level
    ]

Just a NOTE : You can only use appendcols after a reporting command (such as stats, chart, or timechart).
let me know if this helps!

0 Karma

zeespl
Explorer

In the above example you have created an event with field having null value. My question is if it does not return any event, then?

0 Karma

mayurr98
Super Champion

ya still the output is same:

try this:

index=si 
| timechart count 
|   appendcols 
     [search index=_internal 
     | dedup log_level 
     |  table log_level
     ]

The main search will give you no results as there is no si index.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...