Splunk Cloud Platform

Tstats on lookup hosts

szukaczov
Engager

Hello,

I have below TSTATS command which is checking the specifig index population with events per day:

 

| tstats count WHERE (index=_internal AND sourcetype=splunkd) OR (index=B) by host,sourcetype,index,_time span=1d

 

I would like to modify it to run the search on only hosts which are in the lookup list servers.csv. 

 

Can you please help me with modification? 

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

I think I see the problem.  An "AND" was missing before the subsearch.  I've corrected my original answer.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Add the lookup in a subsearch with the where clause.

 

| tstats count WHERE (index=_internal AND sourcetype=splunkd) OR (index=B) AND [ | inputlookup servers.csv | return 1000 host] by host,sourcetype,index,_time span=1d

 

---
If this reply helps you, Karma would be appreciated.

szukaczov
Engager

Thank you @richgalloway , for your assistance. I have checked the query and I have error:

 

"may have returned partial results. Try running your search again. If you see this error repeatedly, review search.log for details or contact your Splunk administrator."

 

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Did you follow the instructions in the error message?  What did you see in search.log?

---
If this reply helps you, Karma would be appreciated.
0 Karma

diirn
Explorer

I think here is the error:

"

08-06-2021 07:34:37.521 ERROR TsidxStats [60531 searchOrchestrator] - Incorrect WHERE clause : [ AND 1000 csv host inputlookup list return server splunk [ OR index::* [ AND index::_internal sourcetype::splunkd ] ] ] 

"

08-06-2021 07:34:37.521 ERROR TsidxStats [60531 searchOrchestrator] - WHERE clause is not an exact query

 

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I think I see the problem.  An "AND" was missing before the subsearch.  I've corrected my original answer.

---
If this reply helps you, Karma would be appreciated.

richgalloway
SplunkTrust
SplunkTrust

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.

---
If this reply helps you, Karma would be appreciated.
0 Karma

diirn
Explorer

Thank you very much, I think the problem is solved! 

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...