tstats index aggregation

[vamsigurram]

Hi,

I have a host.csv, with 20K+ hosts in it.

I am expecting values(index) by host.

But tstats gives error for the below command.

| tstats values(index) where index=* [| inputlookup eft_hosts2.csv | format ] by host 

I get below error.

Error in 'TsidxStats': Aggregations are not supported for index, splunk_server and splunk_server_group

I do not want to use the stats command as shown below, becasue it will never complete and very performance intensive.

index=* [| inputlookup eft_hosts2.csv | format ]  | stats values(index) by host

is there any other command that can search meta files and do index aggregation per host?

[renjith_nair · Accepted solution]

Does this help ?

|  tstats count  where index="*" [| inputlookup eft_hosts2.csv | format ]  by host,index|stats values(index) by host