Stats sum function causing fields to drop off

[rmcdougal]

I am writing a search against a summary index and I am running into an interesting problem. When I perform a sum on one specific field all the other fields drop off. For example, this search returns proper results

index=network_summary source="Top Perimeter Accepts by Source IP" | table src_ip, dns_name, count

This search returns the count and src_ip but not the dns_name

index=network_summary source="Top Perimeter Accepts by Source IP" | stats sum(count) by src_ip | table src_ip, dns_name, sum(count)

Any ideas what I may be doing wrong?

[martin_mueller · Accepted solution]

Stats replaces the raw events with what you specified, the sum of the field count grouped by src_ip. That does not contain dns_name, hence stats correctly drops that field.

That's not specific to summary indexes, but rather what stats does. Consider this:

index=_internal | stats count by sourcetype

Here stats will drop everything except the sourcetype field and count grouped by that. You'll lose _raw, _time, source, host, and so on.

If you want to maintain dns_name information you'll have to expand your stats command's parameters. Assuming dns_name is unique for each src_ip, you could do this:

... | stats sum(count) values(dns_name) as dns_name by src_ip

This will list all values of dns_name grouped by src_ip alongside the sum of counts.