How to get index in the results with respective sourcetype?

[PavanSeerapu]

index=_internal source=*metrics.log

| eval MB=round(kb/1024,2)

| search group="per_sourcetype_thruput"

| stats sum(MB) by series | eval sourcetype=lower(series)

| table index sourcetype "sum(MB)"

| append [| tstats latest(_time) as latest where index=* earliest=-24h by sourcetype |eval LastReceivedEventTime = strftime(latest,"%c") |table index, sourcetype LastReceivedEventTime | eval sourcetype=lower(sourcetype)]

| stats values(*) as * by sourcetype

| where LastReceivedEventTime != ""

Above query giving me sourtype, latest time stamp and sum(MB), but unable to get index, can someone please help

[gcusello]

Hi @PavanSeerapu,

after a stats command, you have only the fields used in the stats, so you have to add the index to all your stats commands,

something like this:

index=_internal source=*metrics.log group="per_sourcetype_thruput"
| eval MB=round(kb/1024,2)
| stats sum(MB) values(index) AS index by series 
| eval sourcetype=lower(series)
| append [ 
   | tstats latest(_time) as latest where index=* earliest=-24h by sourcetype
   | eval LastReceivedEventTime = strftime(latest,"%c") 
   | table index sourcetype LastReceivedEventTime 
   | eval sourcetype=lower(sourcetype)
   ]
| stats values(*) as * by sourcetype
| where LastReceivedEventTime != ""

Ciao.

Giuseppe

[Amick]

Add index to your subsearch "by" clause

index=_internal source=*metrics.log group="per_sourcetype_thruput"
| eval MB=round(kb/1024,2)
| stats sum(MB) by series | eval sourcetype=lower(series)
| table index sourcetype "sum(MB)"
| append [| tstats latest(_time) as latest where index=* earliest=-24h by index, sourcetype |eval LastReceivedEventTime = strftime(latest,"%c") |table index, sourcetype LastReceivedEventTime | eval sourcetype=lower(sourcetype)]
| stats values(*) as * by sourcetype
| where LastReceivedEventTime != ""