topic Re: How to use custom key field in tstats? in Splunk Search

How to use custom key field in tstats?

GaryZ — Thu, 07 Sep 2023 21:58:23 GMT

I'm having trouble capturing the custom key - "UserKey_ABC" in the following script. With the following code, I'm not able to see any results. However, if I remove "UserKey_ABC", I am able to get the results. I'm certain I do have this key in my events. How do I approach this issue?

| tstats count where index=abc Arguments.email=“myemail@abc.com" by

device_build, Arguments.test_url, UserKey_ABC

| rename UserKey_ABC.Day as day,

UserKey_ABC.job1 as job1,

UserKey_ABC.Version as version,

Arguments.test_url as test_url,

device_build as build

| table build, lib, day, job1, version, test_url

Re: How to use custom key field in tstats?

yuanliu — Thu, 07 Sep 2023 23:36:38 GMT

tstats only operates on indexed fields. You can still use the fields in statistical functions. So, you need to define how you want to see these values, and you cannot use them in groupby.

Re: How to use custom key field in tstats?

GaryZ — Thu, 07 Sep 2023 23:52:14 GMT

@yuanliu I'm fairly new to Splunk this year. Can you explain what you mean? - "You can still use the fields in statistical functions"

I've tried

| tstats count where index=abc Arguments.email=“myemail@abc.com" by

device_build, Arguments.test_url, UserKey_ABC.job1

| rename UserKey_ABC.Day as day,

UserKey_ABC.job1 as job1

But that didn't work for me either.

Thanks.

Re: How to use custom key field in tstats?

yuanliu — Thu, 07 Sep 2023 23:58:08 GMT

That's because at index time (when Splunk ingests data), fields like UserKey_ABC.job1 doesn't exist. They are extracted at search time by some mechanism, but do not exist in indexer.