tstats index aggregation

vamsigurram — Sun, 06 Sep 2020 16:56:56 GMT

Hi,

I have a host.csv, with 20K+ hosts in it.

I am expecting values(index) by host.

But tstats gives error for the below command.

| tstats values(index) where index=* [| inputlookup eft_hosts2.csv | format ] by host

I get below error.

Error in 'TsidxStats': Aggregations are not supported for index, splunk_server and splunk_server_group

I do not want to use the stats command as shown below, becasue it will never complete and very performance intensive.

index=* [| inputlookup eft_hosts2.csv | format ] | stats values(index) by host

is there any other command that can search meta files and do index aggregation per host?

Re: tstats index aggregation

renjith_nair — Mon, 07 Sep 2020 03:37:16 GMT

Does this help ?

| tstats count where index="*" [| inputlookup eft_hosts2.csv | format ] by host,index|stats values(index) by host