site value not populating correctley

[Ram2]

We have a query where we are  getting the count by site.

index=test-index |stats count by host site.

When we run this query in search head cluster we are getting output as 

site                       host

undefined         appdtz

undefined        appstd

undefined        apprtg

undefined        appthf

When we run the same query in deployer we are getting output correctly with site.

site                       host

sitea         appdtz

sitea       appstd

siteb        apprtg

siteb        appthf

 how to fix this issue in SH cluster.

[gcusello]

Hi @Ram2 ,

probaby you runned the search on SHC outside the app where the site fied is extracted.

have you in the events the site field?

Ciao.

Giuseppe

[Ram2]

Hi @gcusello ,

probaby you runned the search on SHC outside the app where the site fied is extracted. --No i am running the same query under search and reporting app  in SHC and Deployer

have you in the events the site field? --No these are default values for a host coming from universal forwarder,  what they set from application side.

[gcusello]

Hi @Ram2 ,

what's the Mode you're using? you must use Verbose.

if the site field isn't extracted, you cannoy use it, did you extracted the site field?

Ciao.

Giuseppe

[Ram2]

@gcusello ,

what's the Mode you're using? you must use Verbose. --running in verbose mode.

if the site field isn't extracted, you cannoy use it, did you extracted the site field? -- The site field is a default field like host sourcetype. 

[gcusello]

Hi @Ram2 ,

host e sourcetype are indextime fields that you associate to your data surce, site should be an extracted field.

Have you this field running only the search without stats?

if not (as probable) you have to extract it.

Ciao.

Giuseppe