Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How to resolve missing calculated field when search is performed via REST API?

$
0
0
I have a query to calculate the average recipient count for Exchange: index=msexchange sourcetype=MSExchange:2010:MessageTracking sender="sunj@advisory.com" ((source_id=STOREDRIVER event_id=RECEIVE) OR (source_id=ROUTING event_id=EXPAND)) | fillnull value=NULL message_subject | eval s_msg_sub=lower(message_subject) | search s_msg_sub!="out of office*" s_msg_sub!="automatic reply*" | dedup internal_message_id | stats max(recipient_count) as max_recipient_count BY internal_message_id | stats count(internal_message_id) as emails_sent, sum(max_recipient_count) as email_recipient_count | table emails_sent, email_recipient_count I have no problem run this query directly via browser. However when running it over REST API call. One of the calculate field is missing from the result: emails_sentemail_recipient_count686 This seems coincide with upgrading from 6.3.0 to 6.4.2. Any thoughts on how to resolve this? Thanks, Jeffery

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>