pivot command filtering and splitting on index


I am trying to do the following:

| pivot Cisco_IOS_Event Cisco_IOS_Event count(Cisco_IOS_Event) AS "Events" dc(host) AS "Unique Devices" dc(index) AS "Unique Indexes" FILTER product in (IOS) FILTER index in (index1,index2)

However this fails as the "index" field is not part of the Cisco_IOS_Event data model.

If I use tstats (which doesn't support real-time searching) it works:

| tstats values(nodename) AS nodename count FROM datamodel=Cisco_IOS_Event WHERE Cisco_IOS_Event.product IN (IOS) index IN (index1,index2) BY host index

I believe if I add "index" as a field to my data model I will be able to filter, but I'm wondering if this is intentional, as tstats supports this without "index" as part of the data model. _time, source, sourcetype and host are inherited fields in all data models, so I'm having a hard time understanding why index isn't.

Tags (2)
0 Karma
Get Updates on the Splunk Community!

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...

Announcing General Availability of Splunk Incident Intelligence!

Digital transformation is real! Across industries, companies big and small are going through rapid digital ...