If I run :
1.index=* | fields action | tscollect namespace=myaction ...(creates tsidx file)
2.The myaction namespace will be created under $SPLUNKHOME/var/lib/splunk/tsidxstats/myaction
3.| tstats count from myaction groupby action ...(read tsidx file)
However, if I don't use a namespace value where does the tsidx get created?
Found it looks like it will be created under :
View solution in original post