Why can't I sum summary data from sistats?

[Jason]

So, I was running ... | sistats count by host, source, sourcetype, field1, field2 and saving it to a summary index.

Then, I wanted to use the summary data to give me lists of hosts, sourcetypes, and sources. No problem, I looked at the summary data and found they were all stored in orig_ variables. (This rewrite only happens with host, source, and sourcetype.)

The problem came when I wanted to create a sum of all "count"s done by the original sistats. It was in a field called psrsvd_gc, but I couldn't use it. It wouldn't play nice and kept saying it was an internal field, or field was not available.

How do I get the sum from summary index data?

[jdunlea_splunk]

I am having the same problem, but it is not with the metadata fields.

eg: SI Search: .... | sistats count by protocol, action, src_bestmatch

Search ON SI: ..... | stats sum(count) as count by protocol

But again, the "count" from the second search is not available?? What is the solution to this?

[peasead]

I'm still confused.

I have this to count the number of web categories and how much data was used for each:
... | sistats count by webcategory,bytes

When I run the following to get the amount of data per category:
... | stats sum(bytes) by webcategory
There is nothing displayed for bytes.

When I run:
... | stats count by bytes
I get the count of how many times each bytes total was used but no web category correlation.

If I can't use:
... | stats sum(bytes) by webcategory
how do I know how many bytes were used for each category?

Should I be using:
... | sistats sum(bytes) by webcategory

[gkanapathy]

Again, you're thinking about it too hard. sistats is supposed to make it easy. If you've used sistats count by x to create the summary data, then you simply use stats count by x to get the results back, not stats sum(count) by x.

[Jason · Accepted solution]

You're thinking about it too hard. By using | sistats count by host, source, sourcetype before, just write a search that is index=summary ... | stats count by orig_host, orig_source, orig_sourcetype, field1, field2 and it will just work. The count will be there and you can sum it up from there.

(Remember host, source, and sourcetype are rewritten when summarized, so use the orig_ fields.)