Deployment Architecture

Understanding TsidxStats and tstats.

Thats_my_usrnme
Explorer

Hello Team,

Everyone has probably seen this error. 

Error in 'TsidxStats': _time aggregations are not yet supported except for count/min/max/range/earliest/latest

I try to understand stats command use which fields.  I don't want to try every field. Can I see this fields list on GUI or CLI?

Labels (1)
Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

That error message is specific to the _time field.  It's listing the only aggregation functions that can be used in tstats with that field; others, like sum, avg, etc., will produce this message.

To see which fields can be used by the tstats command, use walklex.

| walklex type=field index=foo
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

That error message is specific to the _time field.  It's listing the only aggregation functions that can be used in tstats with that field; others, like sum, avg, etc., will produce this message.

To see which fields can be used by the tstats command, use walklex.

| walklex type=field index=foo
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...

Adoption of Infrastructure Monitoring at Splunk

  Splunk's Growth Engineering team showcases one of their first Splunk product adoption-Splunk Infrastructure ...

Modern way of developing distributed application using OTel

Recently, I had the opportunity to work on a complex microservice using Spring boot and Quarkus to develop a ...