Hi,
I have a host.csv, with 20K+ hosts in it.
I am expecting values(index) by host.
But tstats gives error for the below command.
| tstats values(index) where index=* [| inputlookup eft_hosts2.csv | format ] by host
I get below error.
Error in 'TsidxStats': Aggregations are not supported for index, splunk_server and splunk_server_group
I do not want to use the stats command as shown below, becasue it will never complete and very performance intensive.
index=* [| inputlookup eft_hosts2.csv | format ] | stats values(index) by host
is there any other command that can search meta files and do index aggregation per host?
Does this help ?
| tstats count where index="*" [| inputlookup eft_hosts2.csv | format ] by host,index|stats values(index) by host
Does this help ?
| tstats count where index="*" [| inputlookup eft_hosts2.csv | format ] by host,index|stats values(index) by host