I have a search to SI index=sec marker=01
When calling the results with
index=sec marker=01 | stats count by log_level, hostname
I get results,,,but :
isnt,,,am i missing something? if this is not possible how can i "SI" this search?
asked 26 Sep '11, 11:55
An SQL-like table pivot should serve as reasonable workaround for this. It's not pretty, but it does work.
The general idea is to take the "rows" containing data for each
This is a fairly common trick done in SQL with a combination of CASE and GROUP BY. I've just adapted it a bit to Splunk's syntax.
Oddly enough, if you change the 'sistats' to stats it'll work fine.
In general you want to be careful using the SI commands, and the rule is that if you do
As to a full explanation of what can go off the rails when you cross the streams and why, it's a little beyond me. In this case it's so weird that it may just be a bug.
The good news is that there isnt really any reason to use sistats in such a simple use case. The fancy statistics that it preserves don't add anything here.
UPDATE: One thing you'll have to watch out if you take this approach and use
I know it's rather late in the piece, but I just hit the same problem. The problem seems to be that the name of the field that is saved in the summary index is different to the one produced by sistats and consequently what is expected by stats running against the si.
in my case the name generated by sistats was psrsvd_ct_eval(MedianDurationAboveObjective > 0) but the name in the index is psrsvd_ct_eval_MedianDurationAboveObjective___0_
So a simple workaround (what must surely be a bug) for me was
answered 12 Dec '11, 22:49