Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Admin Other
- :
- Knowledge Management
- :
- fileds command used in summary index not showin co...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi..
i have a main search which is given the count of id 's and writin to a summary index -summary
my summary index generator search
index="main" |sistats count by UniqueID,UniqueName
index="main" | stats count by UniqueID,UniqueName
index="summary" | fields UniqueID,UniqueName | stats count by UniqueID,UniqueName
both are showin different values..is this because of using fields in summary indexed data..
pls help..
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
When you summary index, you are only storing the basic statistics necessary to re-create the original summary table. So if your original search ends in sistats count by UniqueID,UniqueName, your search to pull data out of the summary should contain stats count by UniqueID,UniqueName - then do your fields, or other commands after that.
(If you think about it, if your original table gave the result "field1=a, count=3", the summary would store this as one event. Doing a "stats count by field1" directly on the summary index would return a value of "field1=a, count=1" because there is only one row in the summary index.)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
When you summary index, you are only storing the basic statistics necessary to re-create the original summary table. So if your original search ends in sistats count by UniqueID,UniqueName, your search to pull data out of the summary should contain stats count by UniqueID,UniqueName - then do your fields, or other commands after that.
(If you think about it, if your original table gave the result "field1=a, count=3", the summary would store this as one event. Doing a "stats count by field1" directly on the summary index would return a value of "field1=a, count=1" because there is only one row in the summary index.)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If it solves your problem, please mark it as the accepted answer and up vote
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
thanx 4 the reply jason
Tech Talk Recap | Mastering Threat Hunting
Observability for AI Applications: Troubleshooting Latency
Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?
