While getting Netflow data using streams, I aggregate a variable "bytes_in" as a sum of the bytes_in received in a flow, this works well, and I get a new variable called "sum(bytes_in)"
The problem I am experiencing is this: Streams in the previous version, used to index the data for the aggregate "sum(bytes_in)" as "bytes_in".
Now since I upgraded to Streams 7.2, Streams indexes the data as "sum(bytes_in)"
And this is causing me a lot of issues when trying to get this data into a data model, every time I try to use this data, the SPL fails
This works in a normal search: I use stats to get the max value of "sum(bytes_in)" and distinguish events by src_ip,dest_ip, etc
index=streams | stats max(sum(bytes_in)) AS bytes_in by src_ip,dest_ip,dest_port,src_port,timestamp | where isnum(bytes_in)
But When I try and import the streams data into a data model, the name of the variable "sum(bytes)" seems to be causing a lot of issues:
error message: "Error in 'eval' command: The 'sum' function is unsupported or undefined."
So I need to either:
- from streams, rename the variable name "sum(bytes_in)" to "bytes_in for example, but I cannot find how to do this in streams
OR
- in the data model, rename the variable name "sum(bytes_in)" to "bytes_in for example, but I cannot seem to find how to do that as well
