Reporting

Why is appendcols no longer working in some scheduled searches in Splunk 6.2?

moataz_gaber
New Member

After upgrade to splunk 6.2 some scheduled PDF are not working ... received the below error
Error in 'appendcols' command: You can only use appendcols after a reporting command (such as stats, chart, or timechart).
Here is my original search
eventtype="general_testcases" | timechart span=1mon dc(user) as "Total"
| appendcols maxtime=600 [search eventtype="test_case_1" | timechart span=1mon dc(user) as "Test1"]
| appendcols maxtime=600 [search eventtype="test_case_2" | timechart span=1mon dc(user) as "Test2"]

I don't know why it is not working anymore ... Please help ASAP

0 Karma

rsimmons
Splunk Employee
Splunk Employee

Splunk is currently aware of this error and its a known issue (SPL-93020), where the error appears to be coming from the AppendProcessor which is extracting it from the search.log. Currently there is no workaround, however the issue will be
addressed in an upcoming release.

Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...