Unsure how to append additional field after stats command.

[dondky]

Hi all, I am trying to do the following search:

sourcetype=squid 192.168.1.20 | stats sum(bytes_in) as bytes by src | eval MB = round (bytes/1024/1024, 2) | top MB by src | fields - count, percent

but I can't seem to figure out how to add an additional field to the result. The field is dest_host which in the squid logs would show the destination URL or IP. My end goal would be something like:

src MB dest_ip
192.168.1.20 20.00 www.google.com

I have tried variants of:

sourcetype=squid 192.168.39.117 | stats sum(bytes_in) as bytes by src | eval MB = round (bytes/1024/1024, 2) | top MB by src | fields - count, percent | table MB, dest_host

with no luck. Should I be using eval?

Thanks for any input.

[Lowell · Accepted solution]

This is the nature of the stats command. As you've seen, after a stats command, the only remaining fields are the ones you explicitly define within the stats command.

There are way to get this to do what you want. Try something like:

Option 1:

sourcetype=squid 192.168.39.117 | stats sum(bytes_in) as bytes, by src, dest_ip | ...

This works, but if dest_ip is sometimes missing in the main events, then the events will be dropped by the stats command. So another option would be this:

Option 2:

sourcetype=squid 192.168.39.117 | stats sum(bytes_in) as bytes, values(dest_ip) as dest_ip by src | ...

This time, if dest_ip has multiple values, then they will be displayed as a multi-valued field. So you have to pick what works best for you.

There are more options, but this should get you going. Good luck!

[dondky]

Awesome, thanks for the help:

sourcetype=squid | stats sum(bytes_in) as bytes, by src, dest_host | eval MB = round (bytes/1024/1024, 2) | fields - bytes

Removing the top command helps.

Thanks again