topic Re: tstats commands in Splunk Enterprise

How to use tstats to make a search faster (getting errors)?

splunkyboy2 — Thu, 24 Sep 2020 15:01:48 GMT

i am attempting to use tstats to make this search faster

index="wss_events" sourcetype=symantec:websecurityservice:scwss-poll
[| inputlookup "WSSIOC4.csv"
| rename match as query
| fields query ]

i get an an error that i dont understand . Can anyone tell me what i need to correct to use tstats , or am i trying to do something impossible ?

Re: tstats commands

thambisetty — Thu, 24 Sep 2020 13:44:53 GMT

you can not use tstats for indexed data. your indexes should be part of datamodel and datamodel should have been accelerated. read about tstats command below:

https://docs.splunk.com/Documentation/Splunk/8.0.6/SearchReference/Tstats

Re: tstats commands

splunkyboy2 — Thu, 24 Sep 2020 14:37:20 GMT

i have made the index a data model , but still getting errors that i cant work out

Re: tstats commands

richgalloway — Thu, 24 Sep 2020 15:06:10 GMT

The tstats command can be used with indexed fields.

Re: tstats commands

richgalloway — Thu, 24 Sep 2020 15:09:38 GMT

When using subsearches, it's a good idea to run the subsearch by itself with | format appended as in

| inputlookup mylookup.csv | rename foo as bar | fields bar | format

The result will show exactly what is added to the main search. If the resulting text is not valid as part of a search then the subsearch must be modified.