fileds command used in summary index not showin correct data ?

[rakesh_498115]

Hi..

i have a main search which is given the count of id 's and writin to a summary index -summary

my summary index generator search
index="main" |sistats count by UniqueID,UniqueName

index="main" | stats count by UniqueID,UniqueName

index="summary" | fields UniqueID,UniqueName | stats count by UniqueID,UniqueName

both are showin different values..is this because of using fields in summary indexed data..
pls help..

[Jason · Accepted solution]

When you summary index, you are only storing the basic statistics necessary to re-create the original summary table. So if your original search ends in sistats count by UniqueID,UniqueName, your search to pull data out of the summary should contain stats count by UniqueID,UniqueName - then do your fields, or other commands after that.

(If you think about it, if your original table gave the result "field1=a, count=3", the summary would store this as one event. Doing a "stats count by field1" directly on the summary index would return a value of "field1=a, count=1" because there is only one row in the summary index.)

[Jason]

If it solves your problem, please mark it as the accepted answer and up vote

[rakesh_498115]

thanx 4 the reply jason