Hi..
i have a main search which is given the count of id 's and writin to a summary index -summary
my summary index generator search
index="main" |sistats count by UniqueID,UniqueName
index="main" | stats count by UniqueID,UniqueName
index="summary" | fields UniqueID,UniqueName | stats count by UniqueID,UniqueName
both are showin different values..is this because of using fields in summary indexed data..
pls help..
When you summary index, you are only storing the basic statistics necessary to re-create the original summary table. So if your original search ends in sistats count by UniqueID,UniqueName
, your search to pull data out of the summary should contain stats count by UniqueID,UniqueName
- then do your fields, or other commands after that.
(If you think about it, if your original table gave the result "field1=a, count=3", the summary would store this as one event. Doing a "stats count by field1" directly on the summary index would return a value of "field1=a, count=1" because there is only one row in the summary index.)
When you summary index, you are only storing the basic statistics necessary to re-create the original summary table. So if your original search ends in sistats count by UniqueID,UniqueName
, your search to pull data out of the summary should contain stats count by UniqueID,UniqueName
- then do your fields, or other commands after that.
(If you think about it, if your original table gave the result "field1=a, count=3", the summary would store this as one event. Doing a "stats count by field1" directly on the summary index would return a value of "field1=a, count=1" because there is only one row in the summary index.)
If it solves your problem, please mark it as the accepted answer and up vote
thanx 4 the reply jason