https://community.splunk.com/t5/Dashboards-Visualizations/Recover-fields-after-stats/m-p/529880#M35967 <P>Hi,</P><P>I have a first dashboard with this query:</P><P>index=ind&nbsp; hostname=* (cat_name=success OR cat_name=failed) service=*<BR />| eval site=substr(DeviceName,1,7) + substr(DeviceName, -4)<BR />| stats values(cat_name) as status by mac service site<BR />| where mvcount(status)=1 and status="failed" and service="x"<BR />| dedup mac<BR />| stats count by site</P><P>In the result I have a count of only "failed" by site. If I click on a count, I go to another dashboard that shows some informations for the specific site. This is the second dashboard query:</P><P><BR />index=ind&nbsp; hostname=* (cat_name=success OR cat_name=failed) service=*<BR />| eval site=substr(DeviceName,1,7) + substr(DeviceName, -4)<BR />| stats values(cat_name) as status by mac service site<BR />| where mvcount(status)=1 and status="failed" and service="x"<BR />| dedup mac<BR />| search site="$token$"<BR />| dedup mac&nbsp;&nbsp;<BR />| table site mac status ip dest</P><P>The problem is that I have not results for ip and dest, I think beacause I lost them after stats command. Can you help me???</P><P>&nbsp;</P><P>Thanks in advance</P> Wed, 18 Nov 2020 10:58:02 GMT marco_massari11 2020-11-18T10:58:02Z https://community.splunk.com/t5/Dashboards-Visualizations/Recover-fields-after-stats/m-p/529880#M35967 <P>Hi,</P><P>I have a first dashboard with this query:</P><P>index=ind&nbsp; hostname=* (cat_name=success OR cat_name=failed) service=*<BR />| eval site=substr(DeviceName,1,7) + substr(DeviceName, -4)<BR />| stats values(cat_name) as status by mac service site<BR />| where mvcount(status)=1 and status="failed" and service="x"<BR />| dedup mac<BR />| stats count by site</P><P>In the result I have a count of only "failed" by site. If I click on a count, I go to another dashboard that shows some informations for the specific site. This is the second dashboard query:</P><P><BR />index=ind&nbsp; hostname=* (cat_name=success OR cat_name=failed) service=*<BR />| eval site=substr(DeviceName,1,7) + substr(DeviceName, -4)<BR />| stats values(cat_name) as status by mac service site<BR />| where mvcount(status)=1 and status="failed" and service="x"<BR />| dedup mac<BR />| search site="$token$"<BR />| dedup mac&nbsp;&nbsp;<BR />| table site mac status ip dest</P><P>The problem is that I have not results for ip and dest, I think beacause I lost them after stats command. Can you help me???</P><P>&nbsp;</P><P>Thanks in advance</P> Wed, 18 Nov 2020 10:58:02 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Recover-fields-after-stats/m-p/529880#M35967 marco_massari11 2020-11-18T10:58:02Z https://community.splunk.com/t5/Dashboards-Visualizations/Recover-fields-after-stats/m-p/529883#M35968 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/228757">@marco_massari11</a>&nbsp;, can you try using eventstats instead of stats?</P> Wed, 18 Nov 2020 11:13:22 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Recover-fields-after-stats/m-p/529883#M35968 t_shreya 2020-11-18T11:13:22Z https://community.splunk.com/t5/Dashboards-Visualizations/Recover-fields-after-stats/m-p/529886#M35969 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225841">@t_shreya</a>&nbsp; It works!!!</P><P>Thank you so much</P> Wed, 18 Nov 2020 11:16:46 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Recover-fields-after-stats/m-p/529886#M35969 marco_massari11 2020-11-18T11:16:46Z