Getting Data In

Why does my tstats search only show results for the main index?

packet_hunter
Contributor
|tstats values(sourcetype) by index

I have 10 indexes, but I only get "main" when I run the search above.

How can I get all my sourcetype(s) by index?

Thanks

Tags (3)
0 Karma
1 Solution

somesoni2
Revered Legend

You need to specify the indexes else, it only shows data from the index set as your "indexes searched by default" in your user/role.

|tstats values(sourcetype) WHERE index=* by index

View solution in original post

somesoni2
Revered Legend

You need to specify the indexes else, it only shows data from the index set as your "indexes searched by default" in your user/role.

|tstats values(sourcetype) WHERE index=* by index
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...