Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Admin Other
- :
- Knowledge Management
- :
- Re: fileds command used in summary index not showi...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi..
i have a main search which is given the count of id 's and writin to a summary index -summary
my summary index generator search
index="main" |sistats count by UniqueID,UniqueName
index="main" | stats count by UniqueID,UniqueName
index="summary" | fields UniqueID,UniqueName | stats count by UniqueID,UniqueName
both are showin different values..is this because of using fields in summary indexed data..
pls help..
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
When you summary index, you are only storing the basic statistics necessary to re-create the original summary table. So if your original search ends in sistats count by UniqueID,UniqueName, your search to pull data out of the summary should contain stats count by UniqueID,UniqueName - then do your fields, or other commands after that.
(If you think about it, if your original table gave the result "field1=a, count=3", the summary would store this as one event. Doing a "stats count by field1" directly on the summary index would return a value of "field1=a, count=1" because there is only one row in the summary index.)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
When you summary index, you are only storing the basic statistics necessary to re-create the original summary table. So if your original search ends in sistats count by UniqueID,UniqueName, your search to pull data out of the summary should contain stats count by UniqueID,UniqueName - then do your fields, or other commands after that.
(If you think about it, if your original table gave the result "field1=a, count=3", the summary would store this as one event. Doing a "stats count by field1" directly on the summary index would return a value of "field1=a, count=1" because there is only one row in the summary index.)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If it solves your problem, please mark it as the accepted answer and up vote
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
thanx 4 the reply jason
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Index This | What travels the world but is also stuck in place?
Discover New Use Cases: Unlock Greater Value from Your Existing Splunk Data
Continue Your Journey: Join Session 2 of the Data Management and Federation Bootcamp ...
