- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- can't get a field to appear when using stats
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
A have a ...| selfjoin subsearch which joins on two fields id, vid. I then pass the fields I want kept to my main search via | fields + id + vid + url. My main search looks for all errors which will only contain the url field not the id and vid fields but it seems since I'm doing a stats my id and vid fields are not populated in the resulting table... help.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The only fields stats passes on to the rest of the search pipeline are the ones involved in the stats calculation. So for instance stats count by id,vid,url will only give you the fields count, id, vid and url.
If you want to calculate stats but still have access to fields, you could look into using eventstats instead. It calculates stats and writes them on a per-event basis, so other fields will not be removed.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The only fields stats passes on to the rest of the search pipeline are the ones involved in the stats calculation. So for instance stats count by id,vid,url will only give you the fields count, id, vid and url.
If you want to calculate stats but still have access to fields, you could look into using eventstats instead. It calculates stats and writes them on a per-event basis, so other fields will not be removed.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Please clarify what you mean by that they "show up" and "go away"? I'm pretty confident that fields will not just go away at the end of a search, ever.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Makes sense but still doesn't explain my issue.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
well. no.
Your indexed events contain information that can be parsed into fields (like vid, url etc). That never changes.
On top of that, you can use commands like eval or eventstats which will create new fields to your events. These only exist in the search you are running, and do not alter the indexed data.
To further confuse this, certain types of command - like stats, chart, transaction etc - will change the concept of "event" for the search you are running, i.e. after a chart command, each row is considered an event, which can be written out or acted upon further.
Makes sense?
/k
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hmm, so my other fields when using either eventstats or stats show up for a few seconds assuming until the search is done and then they go away... thoughts?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
more information needed. submit sample events, with further explanation if necessary. also, please describe your desired output.
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
