topic Re: tstats by index by month Error in 'TsidxStats': WHERE clause is not an exact query in Splunk Search

tstats by index by month Error in 'TsidxStats': WHERE clause is not an exact query

daymar23 — Tue, 11 May 2021 19:26:11 GMT

Hello Community!

I am trying to get the record count by index that I am getting per month in Splunk. I am using this search with tstats, because there are millions of records per month and from I read this is more efficient than the stats command.

| tstats count WHERE (index=*) BY index _time span=1mon | timechart span=1mon count

But I don't know why I am receiving this error:

Error in 'TsidxStats': WHERE clause is not an exact query

Can anyone help me to know what I am doing wrong?

Thanks

Re: tstats by index by month Error in 'TsidxStats': WHERE clause is not an exact query

richgalloway — Wed, 12 May 2021 00:28:38 GMT

That query works fine on 8.1. What version are you using? Have you tried without the parentheses?

Re: tstats by index by month Error in 'TsidxStats': WHERE clause is not an exact query

daymar23 — Wed, 12 May 2021 13:48:04 GMT

I have Version:7.2.1 😞

Yes I have already tried without parentheses.

Do you know how I can do it in this version?

Re: tstats by index by month Error in 'TsidxStats': WHERE clause is not an exact query

richgalloway — Wed, 12 May 2021 21:02:26 GMT

Sorry, I don't know. Perhaps upgrading to 7.3.x will help (7.2 is not supported now).

Re: tstats by index by month Error in 'TsidxStats': WHERE clause is not an exact query

allenclarke — Thu, 10 Jun 2021 12:59:53 GMT

I get the same issue. Can't get any searches with tstats to run, they all error in the same way.

Running Splunk 8.2