sum(count) returning 0 events

[pedropiin]

Hi everyone.

I have a query that basically filters certain events and sums them by category. But I'm facing issues when dealing with stats sum.

The query is of the form

index=main source=...
...
...
| stats count BY name, ticket
| stats sum(count) as numOfTickets by name

Using some test data, removing the last line gives me a table with only one row of the form:
" name    | tickets               | count "
" name1 | ticket_name1 | 1"
(considering the first line as the names of the fields).
Whenever I run the last line, that is, "stats sum(count)..." , it returns 0 events. 

I've already tried to, for example, redundantly check that count is a numeric value by doing "eval count = tonumber(count)".

Why is this happening?

Thank you in advance

[ITWhisperer]

Your sample test data shows a field called "tickets" when your stats command is using a field called "ticket" - is it simply a typo in your example, or in your actual search?

[gcusello]

Hi @pedropiin ,

this search hasn't sense, you could run:

index=main source=...
...
...
| stats count BY name

Ciao.

Giuseppe

[pedropiin]

Hi Giuseppe. Thank you for your response.

This is just with test data. When I deal with a real scenario, face the same issue but it I can't simply run "count".

[gcusello]

Hi @pedropiin ,

there isn't any reason for your behavior: after a stats command you have only the fields present in the command.

Could you share the full search?

Ciao.

Giuseppe