https://community.splunk.com/t5/Splunk-Search/can-t-get-a-field-to-appear-when-using-stats/m-p/77548#M181557 <P>well. no. <BR /> Your indexed events contain information that can be parsed into fields (like vid, url etc). That never changes.</P> <P>On top of that, you can use commands like eval or eventstats which will create new fields to your events. These only exist in the search you are running, and do not alter the indexed data.</P> <P>To further confuse this, certain types of command - like stats, chart, transaction etc - will change the concept of "event" for the search you are running, i.e. after a chart command, each row is considered an event, which can be written out or acted upon further.</P> <P>Makes sense?</P> <P>/k</P> Fri, 04 Jan 2013 09:50:39 GMT kristian_kolb 2013-01-04T09:50:39Z https://community.splunk.com/t5/Splunk-Search/can-t-get-a-field-to-appear-when-using-stats/m-p/77544#M181553 <P>A have a ...| selfjoin subsearch which joins on two fields id, vid. I then pass the fields I want kept to my main search via | fields + id + vid + url. My main search looks for all errors which will only contain the url field not the id and vid fields but it seems since I'm doing a stats my id and vid fields are not populated in the resulting table... help.</P> Thu, 03 Jan 2013 21:05:46 GMT https://community.splunk.com/t5/Splunk-Search/can-t-get-a-field-to-appear-when-using-stats/m-p/77544#M181553 tb5821 2013-01-03T21:05:46Z https://community.splunk.com/t5/Splunk-Search/can-t-get-a-field-to-appear-when-using-stats/m-p/77545#M181554 <P>more information needed. submit sample events, with further explanation if necessary. also, please describe your desired output.</P> Thu, 03 Jan 2013 21:16:33 GMT https://community.splunk.com/t5/Splunk-Search/can-t-get-a-field-to-appear-when-using-stats/m-p/77545#M181554 kristian_kolb 2013-01-03T21:16:33Z https://community.splunk.com/t5/Splunk-Search/can-t-get-a-field-to-appear-when-using-stats/m-p/77546#M181555 <P>The only fields <CODE>stats</CODE> passes on to the rest of the search pipeline are the ones involved in the stats calculation. So for instance <CODE>stats count by id,vid,url</CODE> will only give you the fields count, id, vid and url.</P> <P>If you want to calculate stats but still have access to fields, you could look into using <CODE>eventstats</CODE> instead. It calculates stats and writes them on a per-event basis, so other fields will not be removed.</P> Thu, 03 Jan 2013 21:27:01 GMT https://community.splunk.com/t5/Splunk-Search/can-t-get-a-field-to-appear-when-using-stats/m-p/77546#M181555 Ayn 2013-01-03T21:27:01Z https://community.splunk.com/t5/Splunk-Search/can-t-get-a-field-to-appear-when-using-stats/m-p/77547#M181556 <P>Hmm, so my other fields when using either eventstats or stats show up for a few seconds assuming until the search is done and then they go away... thoughts?</P> Thu, 03 Jan 2013 22:59:46 GMT https://community.splunk.com/t5/Splunk-Search/can-t-get-a-field-to-appear-when-using-stats/m-p/77547#M181556 tb5821 2013-01-03T22:59:46Z https://community.splunk.com/t5/Splunk-Search/can-t-get-a-field-to-appear-when-using-stats/m-p/77548#M181557 <P>well. no. <BR /> Your indexed events contain information that can be parsed into fields (like vid, url etc). That never changes.</P> <P>On top of that, you can use commands like eval or eventstats which will create new fields to your events. These only exist in the search you are running, and do not alter the indexed data.</P> <P>To further confuse this, certain types of command - like stats, chart, transaction etc - will change the concept of "event" for the search you are running, i.e. after a chart command, each row is considered an event, which can be written out or acted upon further.</P> <P>Makes sense?</P> <P>/k</P> Fri, 04 Jan 2013 09:50:39 GMT https://community.splunk.com/t5/Splunk-Search/can-t-get-a-field-to-appear-when-using-stats/m-p/77548#M181557 kristian_kolb 2013-01-04T09:50:39Z https://community.splunk.com/t5/Splunk-Search/can-t-get-a-field-to-appear-when-using-stats/m-p/77549#M181558 <P>Makes sense but still doesn't explain my issue.</P> Fri, 04 Jan 2013 14:00:53 GMT https://community.splunk.com/t5/Splunk-Search/can-t-get-a-field-to-appear-when-using-stats/m-p/77549#M181558 tb5821 2013-01-04T14:00:53Z https://community.splunk.com/t5/Splunk-Search/can-t-get-a-field-to-appear-when-using-stats/m-p/77550#M181559 <P>Please clarify what you mean by that they "show up" and "go away"? I'm pretty confident that fields will not just go away at the end of a search, ever.</P> Fri, 04 Jan 2013 16:12:48 GMT https://community.splunk.com/t5/Splunk-Search/can-t-get-a-field-to-appear-when-using-stats/m-p/77550#M181559 Ayn 2013-01-04T16:12:48Z