Why is the stats command wiping out a custom extracted field from my search results?

[_dave_b]

Hello. if I run a search like this:

"..." | dedup 2 correlationId | eval EpochTime = _time | eval nowTimeEpoch=time() | eval minTime=0 | eval maxTime=1 | stats min(EpochTime) as minTime  max(EpochTime) as maxTime | table minTime, maxTime, correlationId

I get epoch time values for minTime and maxTime, but nothing for the correlationId, which is a custom field extracted by a regular expression.

If I change the search by removing the stats component, I get a value for correlationId, and default dummy values 0 and 1 for minTime and maxTime. Apparently when stats is run, it does something to wipe out the value for correlationId. Why does this happen, and how can I get the stats functions to work harmoniously so that I can parse and see all the values?

Thanks for your help

[sundareshr · Accepted solution]

Try this

..| stats min(EpochTime) as minTime max(EpochTime) as maxTime by correlationId

[_dave_b]

That does it! thanks for the quick reply

[jeffland]

Did you understand WHY your field is not available after a stats command? You should have a look here.