how come some fields disappear when they go into timechart/chart?

[sideview]

Im trying to use timechart to pass along the values of a particular field for each time bucket.

I know that the fields are there, and that the fields exist in 100% of the events. However values() and first() are not finding them:

eg:

index="_internal" source="*metrics.log" group=tcpin_connections sourceHost=* | timechart values(sourceHost) dc(sourceHost)

happily tells me that there are 8 distinct sourceHost values per time bucket, but the values(sourceHost) column says there are no values, and the UI gives me the error:

Specified field(s) missing from results: 'sourceHost'

I've also noticed that some fields like 'destPort' however, are passed along by values() and first() just fine.

[sideview · Accepted solution]

What's happening is that timechart and chart try to convert the fields to numeric fields. If that conversion fails for a particular row, they actually throw the field values away.

This is why your values(destPort) works fine, but values(sourceHost) does not. The former survives the conversion.

Although this really seems like a bug, to play devil's advocate, chart and timechart are trying their best to return chartable results. And while categorical values in x-axis and the columns are just fine, in the middle of the table it is just forcing everything to become a number or perish.

The same thing is at work when you have one or two values that pollute your otherwise numeric data -- timechart and chart will have the nice behaviour of ignoring those values for you, and calculate avg() and max() from the remaining values.

Solution: use bin and stats instead of timechart. (or if you're using chart, use stats instead of chart)

Most of the time you'll be able to do whatever it is with stats and other commands. In this particular example it would look like:

bin _time span=5m | stats values(sourceHost) by _time