Deployment Architecture

Understanding TsidxStats and tstats.

Thats_my_usrnme
Explorer

Hello Team,

Everyone has probably seen this error. 

Error in 'TsidxStats': _time aggregations are not yet supported except for count/min/max/range/earliest/latest

I try to understand stats command use which fields.  I don't want to try every field. Can I see this fields list on GUI or CLI?

Labels (1)
Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

That error message is specific to the _time field.  It's listing the only aggregation functions that can be used in tstats with that field; others, like sum, avg, etc., will produce this message.

To see which fields can be used by the tstats command, use walklex.

| walklex type=field index=foo
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

That error message is specific to the _time field.  It's listing the only aggregation functions that can be used in tstats with that field; others, like sum, avg, etc., will produce this message.

To see which fields can be used by the tstats command, use walklex.

| walklex type=field index=foo
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...