| tstats count where index=proxy AND sourcetype=dns earliest=-7d by _time, ComputerName span=1h | xyseries _time, ComputerName, count
So this is an actual field with an actual value and it isnt loading into the search, any reason why?
All fields used by tstats must be indexed. Are you sure ComputerName is extracted at index-time and not at search-time?
tstats
Its a custom made field. So probably at search time.... is there a way around this
or a way to find out
| walklex type=field index=* | stats values(field) by index will list all of your indexed fields.
| walklex type=field index=* | stats values(field) by index
