I am writing a search against a summary index and I am running into an interesting problem. When I perform a sum on one specific field all the other fields drop off. For example, this search returns proper results
index=network_summary source="Top Perimeter Accepts by Source IP" | table src_ip, dns_name, count
This search returns the count and src_ip but not the dns_name
index=network_summary source="Top Perimeter Accepts by Source IP" | stats sum(count) by src_ip | table src_ip, dns_name, sum(count)
Any ideas what I may be doing wrong?
Stats replaces the raw events with what you specified, the sum of the field count grouped by src_ip. That does not contain dns_name, hence stats correctly drops that field.
That's not specific to summary indexes, but rather what stats does. Consider this:
index=_internal | stats count by sourcetype
Here stats will drop everything except the sourcetype field and count grouped by that. You'll lose _raw, _time, source, host, and so on.
If you want to maintain dns_name information you'll have to expand your stats command's parameters. Assuming dns_name is unique for each src_ip, you could do this:
... | stats sum(count) values(dns_name) as dns_name by src_ip
This will list all values of dns_name grouped by src_ip alongside the sum of counts.
Stats replaces the raw events with what you specified, the sum of the field count grouped by src_ip. That does not contain dns_name, hence stats correctly drops that field.
That's not specific to summary indexes, but rather what stats does. Consider this:
index=_internal | stats count by sourcetype
Here stats will drop everything except the sourcetype field and count grouped by that. You'll lose _raw, _time, source, host, and so on.
If you want to maintain dns_name information you'll have to expand your stats command's parameters. Assuming dns_name is unique for each src_ip, you could do this:
... | stats sum(count) values(dns_name) as dns_name by src_ip
This will list all values of dns_name grouped by src_ip alongside the sum of counts.