topic Re: Can you help me use the tstats command with a fillnull? in Splunk Search

Can you help me use the tstats command with a fillnull?

chris94089 — Tue, 16 Oct 2018 22:58:12 GMT

Greetings,

So, I want to use the tstats command. It's super fast and efficient. But not if it's going to remove important results. Any record that happens to have just one null value at search time just gets eliminated from the count. That's important data to know.

With classic search I would do this:

index=* mysearch=*
| fillnull value="null" field1 field2 (etc...)
| stats count by field1 field2 (etc...)

with this, I see my events, and if one shows up as "null" in a couple fields, well, I know it was empty!

Can this be accomplished with the tstats command? Thank you so much.

Sincerely,
A want-to-be tstats advocate

Re: Can you help me use the tstats command with a fillnull?

kamlesh_vaghela — Wed, 17 Oct 2018 12:48:15 GMT

@chris94089

Can you please try this?

|tstats count values(field1) as field1 values(field2) as field2 where index=YOUR_INDEX by _time | fillnull field1 field2 value="NULL" | stats sum(count) as count by  field1 field2

My Sample Search:

|tstats count values(component) as component where index=_internal by _time index | fillnull component value="NULL" | stats sum(count) as count by  component

Thanks

Re: Can you help me use the tstats command with a fillnull?

harsmarvania57 — Wed, 17 Oct 2018 15:51:34 GMT

Hi @kamlesh_vaghela,

It looks like only those fields we can use with tstats which is extracted at time of indexing, as I am running walklex on _internal index bucket and I can see component field in tsidx file so we can use that in tstats but not other fields like bytes from _internal index with above query (If we use datamodel then we can definitely use that 🙂 but without datamodel I think tstats limits with only fields which are extracted at index time)