Dashboards & Visualizations

eventcount not working with realtime search


time dependent searches with realtime time range not working in dropdown on simple XML.

<input type="dropdown" token="index" searchWhenChanged="true">
                <query>| eventcount summarize=false index=* | dedup index | search NOT (index=main OR index=summary OR index=history)</query>
            <choice value="*">All</choice>

getting error dashboard as Error in 'eventcount' command: This command is not supported in a real-time search:
alt text

same error for tstats query also
| tstats prestats=t count WHERE host=$host$ index= NOT (index=main OR index=summary OR index=history) GROUPBY index | stats count by index | where count > 0*

Kindly help me on this, If not possible is there any work around or alternatives for this error.

0 Karma

Ultra Champion

well, the tstats command(maybe, eventcount also) is used to perform statistical queries on indexed fields in tsidx files.
for real-time searches, the tsidx files will not be available, as the search itself is real-time.

document also says this
eventcount Description
Returns the number of events in the specified indexes.
Note: You cannot use this command over different time ranges.

we can use stats command for real-time searches

index=* | stats count BY index

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...