Hi all, I am trying to do the following search:
sourcetype=squid 192.168.1.20 | stats sum(bytes_in) as bytes by src | eval MB = round (bytes/1024/1024, 2) | top MB by src | fields - count, percent
but I can't seem to figure out how to add an additional field to the result. The field is dest_host which in the squid logs would show the destination URL or IP. My end goal would be something like:
src MB dest_ip
192.168.1.20 20.00 www.google.com
I have tried variants of:
sourcetype=squid 192.168.39.117 | stats sum(bytes_in) as bytes by src | eval MB = round (bytes/1024/1024, 2) | top MB by src | fields - count, percent | table MB, dest_host
with no luck. Should I be using eval?
Thanks for any input.
This is the nature of the stats
command. As you've seen, after a stats
command, the only remaining fields are the ones you explicitly define within the stats
command.
There are way to get this to do what you want. Try something like:
sourcetype=squid 192.168.39.117 | stats sum(bytes_in) as bytes, by src, dest_ip | ...
This works, but if dest_ip
is sometimes missing in the main events, then the events will be dropped by the stats command. So another option would be this:
sourcetype=squid 192.168.39.117 | stats sum(bytes_in) as bytes, values(dest_ip) as dest_ip by src | ...
This time, if dest_ip
has multiple values, then they will be displayed as a multi-valued field. So you have to pick what works best for you.
There are more options, but this should get you going. Good luck!
This is the nature of the stats
command. As you've seen, after a stats
command, the only remaining fields are the ones you explicitly define within the stats
command.
There are way to get this to do what you want. Try something like:
sourcetype=squid 192.168.39.117 | stats sum(bytes_in) as bytes, by src, dest_ip | ...
This works, but if dest_ip
is sometimes missing in the main events, then the events will be dropped by the stats command. So another option would be this:
sourcetype=squid 192.168.39.117 | stats sum(bytes_in) as bytes, values(dest_ip) as dest_ip by src | ...
This time, if dest_ip
has multiple values, then they will be displayed as a multi-valued field. So you have to pick what works best for you.
There are more options, but this should get you going. Good luck!
Awesome, thanks for the help:
sourcetype=squid | stats sum(bytes_in) as bytes, by src, dest_host | eval MB = round (bytes/1024/1024, 2) | fields - bytes
Removing the top command helps.
Thanks again