topic Re: fileds command used in summary index not showin correct data ? in Knowledge Management

fileds command used in summary index not showin correct data ?

rakesh_498115 — Sat, 23 Mar 2013 00:16:34 GMT

Hi..

i have a main search which is given the count of id 's and writin to a summary index -summary

my summary index generator search
index="main" |sistats count by UniqueID,UniqueName

index="main" | stats count by UniqueID,UniqueName

index="summary" | fields UniqueID,UniqueName | stats count by UniqueID,UniqueName

both are showin different values..is this because of using fields in summary indexed data..
pls help..

Re: fileds command used in summary index not showin correct data ?

Jason — Mon, 25 Mar 2013 18:28:26 GMT

When you summary index, you are only storing the basic statistics necessary to re-create the original summary table. So if your original search ends in sistats count by UniqueID,UniqueName, your search to pull data out of the summary should contain stats count by UniqueID,UniqueName - then do your fields, or other commands after that.

(If you think about it, if your original table gave the result "field1=a, count=3", the summary would store this as one event. Doing a "stats count by field1" directly on the summary index would return a value of "field1=a, count=1" because there is only one row in the summary index.)

Re: fileds command used in summary index not showin correct data ?

rakesh_498115 — Mon, 25 Mar 2013 19:34:13 GMT

thanx 4 the reply jason

Re: fileds command used in summary index not showin correct data ?

Jason — Mon, 25 Mar 2013 19:49:12 GMT

If it solves your problem, please mark it as the accepted answer and up vote