The Web datamodel contains negative values for bytes ingested from Umbrella proxylogs
below is the query that we are using for the search
| tstats `summariesonly` sum(Web.bytes_out) as size_out, sum(Web.bytes_in) as size_in, values(Web.http_method) as method
from datamodel=Web.Web by Web.user,Web.url, _time span=1d
| `drop_dm_object_name("Web")`
Hi @nagamadhupriyan ,
you should see how Datampdel is populated, maybe it uses a wrong field or a wrong field extraction.
Ciao.
Giuseppe
Hi
byte field :case(isnum(bytes),bytes,isnum(bytes_in) AND isnum(bytes_out),
bytes_in+bytes_out,1=1,null())