Hello Team,
Everyone has probably seen this error.
Error in 'TsidxStats': _time aggregations are not yet supported except for count/min/max/range/earliest/latest
I try to understand stats command use which fields. I don't want to try every field. Can I see this fields list on GUI or CLI?
That error message is specific to the _time field. It's listing the only aggregation functions that can be used in tstats with that field; others, like sum, avg, etc., will produce this message.
To see which fields can be used by the tstats command, use walklex.
| walklex type=field index=foo
That error message is specific to the _time field. It's listing the only aggregation functions that can be used in tstats with that field; others, like sum, avg, etc., will produce this message.
To see which fields can be used by the tstats command, use walklex.
| walklex type=field index=foo