Web datamodel contains negative values for bytes ingested from Umbrella proxylogs

[nagamadhupriyan]

The Web datamodel contains negative values for bytes ingested from Umbrella proxylogs

below is the query that we are using for the search

| tstats `summariesonly` sum(Web.bytes_out) as size_out, sum(Web.bytes_in) as size_in, values(Web.http_method) as method
from datamodel=Web.Web by Web.user,Web.url, _time span=1d
| `drop_dm_object_name("Web")`

[gcusello]

Hi @nagamadhupriyan ,

you should see how Datampdel is populated, maybe it uses a wrong field or a wrong field extraction.

Ciao.

Giuseppe

[nagamadhupriyan]

Hi 

byte field :case(isnum(bytes),bytes,isnum(bytes_in) AND isnum(bytes_out),
bytes_in+bytes_out,1=1,null())