For me this doesn't work.
I'm using a Summary-Search with | mcollect
I even tried to explicitly specify the fields:
index=_internal source=*license_usage.log type="Usage"
| eval h=if(len(h)=0 OR isnull(h),"(SQUASHED)",h)
| eval s=if(len(s)=0 OR isnull(s),"(SQUASHED)",s)
| eval idx=if(len(idx)=0 OR isnull(idx),"(UNKNOWN)",idx)
| bin _time span=1h
| stats sum(b) as _value by _time, pool, s, st, h, idx, date_wday, date_hour
| eval metric_name="license_usage.used_bytes"
| mcollect index=summary_license_metric
Any ideas?
... View more