pivot command filtering and splitting on index


I am trying to do the following:

| pivot Cisco_IOS_Event Cisco_IOS_Event count(Cisco_IOS_Event) AS "Events" dc(host) AS "Unique Devices" dc(index) AS "Unique Indexes" FILTER product in (IOS) FILTER index in (index1,index2)

However this fails as the "index" field is not part of the Cisco_IOS_Event data model.

If I use tstats (which doesn't support real-time searching) it works:

| tstats values(nodename) AS nodename count FROM datamodel=Cisco_IOS_Event WHERE Cisco_IOS_Event.product IN (IOS) index IN (index1,index2) BY host index

I believe if I add "index" as a field to my data model I will be able to filter, but I'm wondering if this is intentional, as tstats supports this without "index" as part of the data model. _time, source, sourcetype and host are inherited fields in all data models, so I'm having a hard time understanding why index isn't.

Tags (2)
0 Karma
Get Updates on the Splunk Community!

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...