Thanks for the feedback @impurush! Possibly I'm not populating the summary index properly. Here is my populating sistats | sistats count(session_id) as session_count, sum(bytes) as bytes, sum(bytes_in) as bytes_in, sum(bytes_out) as bytes_out, sum(duration) as duration, by src_location, dest_port, action, _time When I run 'fieldsummary', I do not see the "bytes" field, only the aggregation fields, although I do see the bytes field associated with the internal mechanisms of the summary index i.e. psrsvd_ct_bytes, psrsvd_sm_bytes. I think I'll hit the docs site for another round of learning to be sure I'm understanding. Ethan
... View more