summary stats functions call back changed in 5.0.*

[yannK]

Before Splunk 5.0.0 , when I had results summarized with stats or timechart, the name of the function was converted using underscores. To call the result back I had to use the "_". This changed with 5.*, to call back you need to use the exact function call.

Example :

• summary generated with a search like "mysummarysearch"

* | timechart span=1h sum(GB) by source

• in 4.* to call it back I need

index=summary search_name=mysummarysearch earliest=24h | stats sum(sum_GB_) by source

• in 5.* to call it back I need

index=summary search_name=mysummarysearch earliest=24h | stats sum(sum(GB)) by source

[yannK · Accepted solution]

I had to go over my searches and fix them, they were able to retrieve all my data