topic Re: How can we use tstats with TERM and PREFIX? in Splunk Search

How can we use tstats with TERM and PREFIX?

danielbb — Thu, 22 Dec 2022 20:40:13 GMT

I'm trying to run -

| tstats count where index=wineventlog* TERM(EventID=4688) by _time span=1m

It returns no results but specifying just the term's value seems to work -

| tstats count where index=wineventlog* TERM(4624) by _time span=1m

https://conf.splunk.com/files/2020/slides/PLA1089C.pdf explains the subject well but my simple query is not working.

Re: How can we use tstats with TERM and PREFIX

richgalloway — Thu, 22 Dec 2022 20:27:55 GMT

The tstats command only works with indexed fields, which usually does not include EventID.

Re: How can we use tstats with TERM and PREFIX?

danielbb — Thu, 22 Dec 2022 21:06:35 GMT

Ok, but TERM(4624) does work.

Re: How can we use tstats with TERM and PREFIX?

richgalloway — Thu, 22 Dec 2022 21:31:11 GMT

Which means that term is stored in a tsidx file (is indexed).

Re: How can we use tstats with TERM and PREFIX?

nordinethales — Thu, 09 Mar 2023 15:40:21 GMT

Hi danielbb,

You can try

| tstats count where index=wineventlog* TERM(EventID=*) by _time span=1m
But in the _raw event, you must have something which corresponds, like

...EventID=4624...

Then, if you want to use this EventID in the group by, you can try (be carefull The text you provide for the PREFIX() directive must be in lower case)

| tstats count where index=wineventlog* TERM(EventID=*) by PREFIX(eventid=) _time span=1m

Regards

Re: How can we use tstats with TERM and PREFIX?

schose — Tue, 28 Mar 2023 17:05:32 GMT

Hi @danielbb ,

It's EventCode, not EventID. 😉

| tstats count where index=wineventlog* TERM(EventCode=4688) by _time span=1m

best regards,

Andreas

Re: How can we use tstats with TERM and PREFIX?

neelwoolies — Mon, 07 Aug 2023 18:03:45 GMT

This is perfect.