topic Whaat is the tstats dynamic way to set the value on index to prevent wildcard? in Splunk Search

Whaat is the tstats dynamic way to set the value on index to prevent wildcard?

kelz — Mon, 06 Jun 2022 21:06:43 GMT

Hi Splunkers,

I was wondering if this is possible on tstats command. Get the dynamic value from savedsearch result or lookup? savedsearch or lookup is updating every hour.

| tstats max(_time) as last_updated WHERE index=* BY index, host

To avoid wildcard.. I was thinking it will be efficient if that is possible.

Appreciate any response.. Thanks!

Re: tstats dynamic way to set the value on index to prevent wildcard

rymundo_splunk — Fri, 03 Jun 2022 07:07:17 GMT

Hi, maybe something like

|tstats count where [|makeresults | eval index="_internal"|fields index] by index, host

That subsearch can return a field named index which then gets used for tstats. Hope this helps.

Re: tstats dynamic way to set the value on index to prevent wildcard

kelz — Fri, 03 Jun 2022 13:05:21 GMT

Thank you so much @rymundo_splunk it works!