topic Re: Field Does Not Exist in Tstats in Splunk Search

How to add a non existing field in tstats command?

whitefang1726 — Wed, 06 Apr 2022 15:28:08 GMT

Hello,

I looking for options to add a non-existing field in tstats command. The scenario is the field doesn't exist. Normally I create regex for searches, however, it doesn't work similar with tstats.

Example Query:

index=something sourcetype=something:something | rex field=source".....(?<new_field>[0-9A-Z]+)"

This command will create new_field field based on source field.

For tstats, the idea should be..

| tstats count max(_time) as _time where ....

Is this possible? Sorry for the lack of details.

Re: Field Does Not Exist in Tstats

venkatasri — Wed, 06 Apr 2022 03:22:11 GMT

tstats only for indexed fields. rex is a search-time.

Refer - https://docs.splunk.com/Documentation/Splunk/8.2.5/Data/Configureindex-timefieldextraction

after successful creation you can use the field in tstats.

Hope it helps!

Re: Field Does Not Exist in Tstats

VatsalJagani — Wed, 06 Apr 2022 05:55:39 GMT

@whitefang1726 - It depends. If all the fields you need are indexed fields then yes you can do it.

For example, you just need to count by new_field extracted from source then you can use something like below query:

| tstats count where index=something sourcetype=something:something by source | rex field=source ".....(?<new_field>[0-9A-Z]+)" | stats sum(count) as count by new_field

I hope this helps!!