Splunk Search

Why is the stats command wiping out a custom extracted field from my search results?

Communicator

Hello. if I run a search like this:

"..." | dedup 2 correlationId | eval EpochTime = _time | eval nowTimeEpoch=time() | eval minTime=0 | eval maxTime=1 | stats min(EpochTime) as minTime  max(EpochTime) as maxTime | table minTime, maxTime, correlationId

I get epoch time values for minTime and maxTime, but nothing for the correlationId, which is a custom field extracted by a regular expression.

If I change the search by removing the stats component, I get a value for correlationId, and default dummy values 0 and 1 for minTime and maxTime. Apparently when stats is run, it does something to wipe out the value for correlationId. Why does this happen, and how can I get the stats functions to work harmoniously so that I can parse and see all the values?

Thanks for your help

0 Karma
1 Solution

Legend

Try this

..| stats min(EpochTime) as minTime max(EpochTime) as maxTime by correlationId

View solution in original post

0 Karma

Legend

Try this

..| stats min(EpochTime) as minTime max(EpochTime) as maxTime by correlationId

View solution in original post

0 Karma

Communicator

That does it! thanks for the quick reply

0 Karma

Champion

Did you understand WHY your field is not available after a stats command? You should have a look here.

Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!