I am trying to do the following:
| pivot Cisco_IOS_Event Cisco_IOS_Event count(Cisco_IOS_Event) AS "Events" dc(host) AS "Unique Devices" dc(index) AS "Unique Indexes" FILTER product in (IOS) FILTER index in (index1,index2)
However this fails as the "index" field is not part of the Cisco_IOS_Event data model.
If I use tstats (which doesn't support real-time searching) it works:
| tstats values(nodename) AS nodename count FROM datamodel=Cisco_IOS_Event WHERE Cisco_IOS_Event.product IN (IOS) index IN (index1,index2) BY host index
I believe if I add "index" as a field to my data model I will be able to filter, but I'm wondering if this is intentional, as tstats supports this without "index" as part of the data model. _time, source, sourcetype and host are inherited fields in all data models, so I'm having a hard time understanding why index isn't.
