Deployment Architecture

Understanding TsidxStats and tstats.

Thats_my_usrnme
Explorer

Hello Team,

Everyone has probably seen this error. 

Error in 'TsidxStats': _time aggregations are not yet supported except for count/min/max/range/earliest/latest

I try to understand stats command use which fields.  I don't want to try every field. Can I see this fields list on GUI or CLI?

Labels (1)
Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

That error message is specific to the _time field.  It's listing the only aggregation functions that can be used in tstats with that field; others, like sum, avg, etc., will produce this message.

To see which fields can be used by the tstats command, use walklex.

| walklex type=field index=foo
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

That error message is specific to the _time field.  It's listing the only aggregation functions that can be used in tstats with that field; others, like sum, avg, etc., will produce this message.

To see which fields can be used by the tstats command, use walklex.

| walklex type=field index=foo
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Fueling your curiosity with new Splunk ILT and eLearning courses

At Splunk Education, we’re driven by curiosity—both ours and yours! That’s why we’re committed to delivering ...

Splunk AI Assistant for SPL 1.1.0 | Now Personalized to Your Environment for Greater ...

Splunk AI Assistant for SPL has transformed how users interact with Splunk, making it easier than ever to ...

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureOn Demand Now Step boldly into the AI revolution with enhanced security ...