Splunk Enterprise Security

In streams, the aggregation of a variable sets the name to "sum(var name)" which causes var name issues later


While getting Netflow data using streams, I aggregate a variable "bytes_in" as a sum of the bytes_in received in a flow, this works well, and I get a new variable called "sum(bytes_in)"

The problem I am experiencing is this: Streams in the previous version, used to index the data for the aggregate "sum(bytes_in)" as "bytes_in".

Now since I upgraded to Streams 7.2, Streams indexes the data as "sum(bytes_in)"

And this is causing me a lot of issues when trying to get this data into a data model, every time I try to use this data, the SPL fails 
This works in a normal search: I use stats to get the max value of "sum(bytes_in)" and distinguish events by src_ip,dest_ip, etc 
index=streams | stats max(sum(bytes_in)) AS bytes_in by src_ip,dest_ip,dest_port,src_port,timestamp | where isnum(bytes_in)

But When I try and import the streams data into a data model, the name of the variable "sum(bytes)" seems to be causing a lot of issues:

error message: "Error in 'eval' command: The 'sum' function is unsupported or undefined."

So I need to either:

- from streams, rename the variable name "sum(bytes_in)" to "bytes_in for example, but I cannot find how to do this in streams


- in the data model, rename the variable name "sum(bytes_in)" to "bytes_in for example, but I cannot seem to find how to do that as well

Labels (1)
0 Karma