topic Re: Tstats where error in Splunk Search

Can I fix this tstats where error?

Imhim — Thu, 08 Jun 2023 14:04:49 GMT

Hi,

So i have this search:

| tstats prestats=true count WHERE index=*_ot (source="*sgre*" OR o_wp="*sgre*") AND (source="*how02*" OR o_wp="*how02*") BY _indextime | eval _time=_indextime | timechart count span=1h

Which gives me the error:

When used for 'tstats' searches, the 'WHERE' clause can contain only indexed fields. Ensure all fields in the 'WHERE' clause are indexed. Properly indexed fields should appear in fields.conf.

Anyone know the solution to this?

Re: Tstats where error

ITWhisperer — Thu, 08 Jun 2023 07:46:12 GMT

index=*_ot (source="*sgre*" OR o_wp="*sgre*") AND (source="*how02*" OR o_wp="*how02*") | stats count BY _indextime | eval _time=_indextime | timechart count span=1h

Or ensure all fields, e.g. o_wp are indexed fields (going forward)

Re: Tstats where error

gcusello — Thu, 08 Jun 2023 07:48:30 GMT

Hi @Imhim,

you can use tstats only on indexed fields, in your case o_wp shouldn't be an indexed field.

This means thatr you cannot use tstats for this search or add o_wp to the indexed fields.

or put all the fields you need for this dataset in a DataModel and use the datamodel for your search.

Ciao.

Giuseppe

Re: Tstats where error

Imhim — Thu, 08 Jun 2023 07:51:44 GMT

Hi @gcusello,

Thank you.

If it needs to be an indexed field, then what would be the optimal approach to this?

Br,

Imhim

Re: Tstats where error

gcusello — Thu, 08 Jun 2023 08:49:18 GMT

Hi @Imhim,

you have three choices:

don't use tstats: if you have few events it's the easiest solution,
add o_wp to indexed fields, it's possible following the procedure at https://docs.splunk.com/Documentation/SplunkCloud/9.0.2209/Data/Configureindex-timefieldextraction ,
use a summary index: following the process described at https://docs.splunk.com/Documentation/Splunk/9.0.4/Knowledge/Aboutsummaryindexing ,
create a DataModel containing all the fields you need for this search (and eventually also others) following the process at https://docs.splunk.com/Documentation/Splunk/9.0.4/Knowledge/Aboutdatamodels .

The best solution depends on your requirements: if you need performaces with many events you can use DataModels or Summary indexes.

Ciao.

Giuseppe

Re: Tstats where error

Imhim — Thu, 08 Jun 2023 09:16:43 GMT

Thank you. I appreciate it