topic Re: using tstats in summary index in Splunk Enterprise

using tstats in summary index

mcohen13 — Sun, 04 Apr 2021 06:55:05 GMT

I have created a summary index from an existing index using tstats

but, when I try to use tstats directly on the data in the summary index it doesn't work, I can only using stats

is there a reason or a workaround?

tscroggins — Sun, 04 Apr 2021 14:12:08 GMT

How did you create the summary index?

mcohen13 — Sun, 04 Apr 2021 16:36:37 GMT

I'm using tstats for creating the data for the summary index

tscroggins — Sun, 04 Apr 2021 16:52:37 GMT

tstats reads data from tsidx files, but it doesn't create them. Can you provide more detailed examples?

mcohen13 — Mon, 05 Apr 2021 06:32:31 GMT

I am using the following search template to create the summary index:

| tstats count as event_count where (index="<index name>")
by <fields> _time span=1d
| stats sum(event_count) as event_count
by <fields>