What is the meaning of the following statement?

[sbgoldberg13]

In the following search:

index=_internal source=*metrics.log group="per_host_thruput" | eval GB=kb/1048576 | stats sum(GB) as total by series | addinfo | eval days = (info_max_time - info_min_time) / 86400 | fields - info* | eval daily_average = total / days

What does the "fields - info*" do?

Thanks.

[somesoni2]

Your query before the | addinfo command calculates the amount of data sent by each host in GB. The | addinfo adds many info* fields in the search which includes the time range (the info_min_time i.e. earliest and info_max_time i.e. latest). You're using those time range epoch valued fields to get number of days in your time range. Once the number of days are calculate, you're removing those info* fields as you don't want to show them, by using | fields - info*.

[sbgoldberg13]

Thanks...!

[harsmarvania57 · Accepted solution]

Hi,

It will remove all fields starting with info from results. When you use | addinfo command it will add info_max_time, info_min_time, info_search_time and info_sid fields. So when you add | fields - info* it will remove all these fields from results.

[sbgoldberg13]

Thanks. That makes sense. 🙂