pivot command filtering and splitting on index


I am trying to do the following:

| pivot Cisco_IOS_Event Cisco_IOS_Event count(Cisco_IOS_Event) AS "Events" dc(host) AS "Unique Devices" dc(index) AS "Unique Indexes" FILTER product in (IOS) FILTER index in (index1,index2)

However this fails as the "index" field is not part of the Cisco_IOS_Event data model.

If I use tstats (which doesn't support real-time searching) it works:

| tstats values(nodename) AS nodename count FROM datamodel=Cisco_IOS_Event WHERE Cisco_IOS_Event.product IN (IOS) index IN (index1,index2) BY host index

I believe if I add "index" as a field to my data model I will be able to filter, but I'm wondering if this is intentional, as tstats supports this without "index" as part of the data model. _time, source, sourcetype and host are inherited fields in all data models, so I'm having a hard time understanding why index isn't.

Tags (2)
0 Karma
Get Updates on the Splunk Community!

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...