Splunk Dev

tstats index aggregation

vamsigurram
Path Finder

Hi,

I have a host.csv, with 20K+ hosts in it.

I am expecting values(index) by host.

But tstats gives error for the below command.

| tstats values(index) where index=* [| inputlookup eft_hosts2.csv | format ] by host 

I get below error.

Error in 'TsidxStats': Aggregations are not supported for index, splunk_server and splunk_server_group

 

I do not want to use the stats command as shown below, becasue it will never complete and very performance intensive.

index=* [| inputlookup eft_hosts2.csv | format ]  | stats values(index) by host

is there any other command that can search meta files and do index aggregation per host?

Labels (1)
0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

Does this help ?

 

|  tstats count  where index="*" [| inputlookup eft_hosts2.csv | format ]  by host,index|stats values(index) by host
Happy Splunking!

View solution in original post

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Does this help ?

 

|  tstats count  where index="*" [| inputlookup eft_hosts2.csv | format ]  by host,index|stats values(index) by host
Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...