Every year I get asked questions like "What was the traffic volume like last year at this time?". And every year I had to say we didn't retain logs long enough to know. But, this year we have Splunk. So I want to setup some summary searches to start capturing this information day by day so I can report on it later. I'm going to start with a simple search like this.
index=foo sourcetype=access_combined host=myhost | sistats count by root, status, method, uri_path
My question is this... If I include lots of fields in the "by" clause of sistats, will I later still be able to aggregate them if I don't care to differentiate? For example, if I summarize using the query above, but later don't care about breaking down by uri_path, will I be able to? I don't want to capture months worth of summary events just to find out I can't generate the report I want later on.
(I'm creating some fake summary events for the next few days so I can run some sample reports to see what I can do. I just thought you guys might have a good answer that we could have here for others to refer to later.)
