Getting the max value of a sum in a summary index

[bowesmana]

I am having trouble getting the max of a sum'd field from a summary index.

I am creating the data with

...
| eval OK=if(status<400,1,0)
| sistats count sum(OK) as OK by host, SystemId, Path, _time

so, I end up with the fields

psrsvd_ct_OK - the count of fields with the OK field
psrsvd_nc_OK - same as ct
psrsvd_sm_OK - the sum of the OK field

I can then do

stats count as Count sum(OK) as OK

but I want to do

stats max(OK) as Max

which would seem to be possible as it has the values to be able to do the sum, but it just returns 'nan'.

Using this

stats count(OK) sum(OK) as OK max(OK) as Max min(OK) as Min

gives me the correct count and correct sum, but nan for the max and min. I've tried using psrsvd_sm_OK but those fields don't seem to work, which doesn't surprise me.

Any ideas?

[micahkemp]

sistats aims to create the data in your summary index to enable the specific aggregations you specified when you ran it. You ran it for count and sum, so only those are available to run with stats.

I would suggest just using stats to create your summary index, thusly:

 | stats count sum(OK) as OK by host, SystemId, Path, _time

This defines specifically what you want your data to look like in your summary index, after which it's up to you to use those previously calculated aggregations properly to calculate your new aggregations.

And then when you need to perform your other stats, you have more granular control:

| stats sum(count) AS count, sum(OK) AS OK | eval avg=OK/count

or

| stats max(OK) AS Max

[bowesmana]

I can't use stats as I need to retain the ability to get percentiles and do dc() operations. I am looking to get a peak request count per minute, so I am bucketing the original data by 1m to get that original sum. I guess I could use eventstats to get the sum and then split by that field also, which would make it a new field in the SI, but just wondered why you couldn't use that existing sum value to get a max of it ...

[micahkemp]

In that case, just pass along all of the aggregations you want to be able to use to your sistats command.

| sistats count sum(OK) max(OK) by host, SystemId, Path, _time

sistats, by definition, limits your abilities with later stats to the aggregations you told it about at summary time.

[bowesmana]

max(OK) is only ever one, as it's used as a counter to count successful and failed requests, so it's the original aggregated sum of events per minute that I then need the max of.