Splunk Dev

tstats index aggregation

vamsigurram
Path Finder

Hi,

I have a host.csv, with 20K+ hosts in it.

I am expecting values(index) by host.

But tstats gives error for the below command.

| tstats values(index) where index=* [| inputlookup eft_hosts2.csv | format ] by host 

I get below error.

Error in 'TsidxStats': Aggregations are not supported for index, splunk_server and splunk_server_group

 

I do not want to use the stats command as shown below, becasue it will never complete and very performance intensive.

index=* [| inputlookup eft_hosts2.csv | format ]  | stats values(index) by host

is there any other command that can search meta files and do index aggregation per host?

Labels (1)
0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

Does this help ?

 

|  tstats count  where index="*" [| inputlookup eft_hosts2.csv | format ]  by host,index|stats values(index) by host
Happy Splunking!

View solution in original post

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Does this help ?

 

|  tstats count  where index="*" [| inputlookup eft_hosts2.csv | format ]  by host,index|stats values(index) by host
Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...