Dashboards & Visualizations

eventcount not working with realtime search


time dependent searches with realtime time range not working in dropdown on simple XML.

<input type="dropdown" token="index" searchWhenChanged="true">
                <query>| eventcount summarize=false index=* | dedup index | search NOT (index=main OR index=summary OR index=history)</query>
            <choice value="*">All</choice>

getting error dashboard as Error in 'eventcount' command: This command is not supported in a real-time search:
alt text

same error for tstats query also
| tstats prestats=t count WHERE host=$host$ index= NOT (index=main OR index=summary OR index=history) GROUPBY index | stats count by index | where count > 0*

Kindly help me on this, If not possible is there any work around or alternatives for this error.

0 Karma

Re: eventcount not working with realtime search


well, the tstats command(maybe, eventcount also) is used to perform statistical queries on indexed fields in tsidx files.
for real-time searches, the tsidx files will not be available, as the search itself is real-time.

document also says this
eventcount Description
Returns the number of events in the specified indexes.
Note: You cannot use this command over different time ranges.

we can use stats command for real-time searches

index=* | stats count BY index

0 Karma