using "eval" in a search form - results table not updating

[briang67]

Hello,

I'm trying to get a form search to work where based on "group" I want an "eval" field called total_bytes to show up in a data table on my dashboard view. My search below works correctly from the search bar, but when I add as a form to a custom view, my result set does not show total_bytes.

Can someone help me to determine what's wrong?
Here's the search that works:

index=nc3sec sourcetype=syslog jav20023: | eval total_bytes = sent + rcvd | stats sum(total_bytes) by group

Here's my xml for the form:

Billing - Select Group

<!-- define master search template; leave time unbounded so that the time input can be used -->
index=nc3sec group="$group$"

<!-- Define a radio button list, populated from a search. searchWhenChanged propagates any change in selection immediatly to the results. -->



Select Group

Any

<![CDATA[index=nc3sec sourcetype=syslog jav20023: | eval total_bytes = sent + rcvd | stats sum(total_bytes) by group]]>

  <!-- add default TimePicker -->  
  <input type="time" />  

  <!-- show results in event viewer -->  
  <table>  
    <title>Total Bytes By Group</title>  
    <option name="count">50</option>  
  </table>  

[Takajian]

I am not sure if this solve your problem. Could you try following search?

"sourcetype=syslog jav20023: | eval total_bytes = sent + rcvd | stats sum(total_bytes) AS total by group | table total group "

Your field "total_bytes" seems not appear just in your row table view. So, I think using table command will help this.