Splunk Search

Stats sum function causing fields to drop off

rmcdougal
Path Finder

I am writing a search against a summary index and I am running into an interesting problem. When I perform a sum on one specific field all the other fields drop off. For example, this search returns proper results

index=network_summary source="Top Perimeter Accepts by Source IP" | table src_ip, dns_name, count

This search returns the count and src_ip but not the dns_name

index=network_summary source="Top Perimeter Accepts by Source IP" | stats sum(count) by src_ip | table src_ip, dns_name, sum(count)

Any ideas what I may be doing wrong?

Tags (1)
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Stats replaces the raw events with what you specified, the sum of the field count grouped by src_ip. That does not contain dns_name, hence stats correctly drops that field.

That's not specific to summary indexes, but rather what stats does. Consider this:

index=_internal | stats count by sourcetype

Here stats will drop everything except the sourcetype field and count grouped by that. You'll lose _raw, _time, source, host, and so on.

If you want to maintain dns_name information you'll have to expand your stats command's parameters. Assuming dns_name is unique for each src_ip, you could do this:

... | stats sum(count) values(dns_name) as dns_name by src_ip

This will list all values of dns_name grouped by src_ip alongside the sum of counts.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Stats replaces the raw events with what you specified, the sum of the field count grouped by src_ip. That does not contain dns_name, hence stats correctly drops that field.

That's not specific to summary indexes, but rather what stats does. Consider this:

index=_internal | stats count by sourcetype

Here stats will drop everything except the sourcetype field and count grouped by that. You'll lose _raw, _time, source, host, and so on.

If you want to maintain dns_name information you'll have to expand your stats command's parameters. Assuming dns_name is unique for each src_ip, you could do this:

... | stats sum(count) values(dns_name) as dns_name by src_ip

This will list all values of dns_name grouped by src_ip alongside the sum of counts.

Get Updates on the Splunk Community!

Streamline Data Ingestion With Deployment Server Essentials

REGISTER NOW!Every day the list of sources Admins are responsible for gets bigger and bigger, often making the ...

Remediate Threats Faster and Simplify Investigations With Splunk Enterprise Security ...

REGISTER NOW!Join us for a Tech Talk around our latest release of Splunk Enterprise Security 7.2! We’ll walk ...

Introduction to Splunk AI

WATCH NOWHow are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. ...