I'm trying to get a form search to work where based on "group" I want an "eval" field called totalbytes to show up in a data table on my dashboard view. My search below works correctly from the search bar, but when I add as a form to a custom view, my result set does not show totalbytes.
Can someone help me to determine what's wrong?
Here's the search that works:
index=nc3sec sourcetype=syslog jav20023: | eval totalbytes = sent + rcvd | stats sum(totalbytes) by group