Splunk Enterprise Security
Highlighted

tstats isn't displaying search

Path Finder

| tstats count where index=proxy AND sourcetype=dns earliest=-7d by _time, ComputerName span=1h
| xyseries _time, ComputerName, count

So this is an actual field with an actual value and it isnt loading into the search, any reason why?

0 Karma
Highlighted

Re: tstats isn't displaying search

SplunkTrust
SplunkTrust

All fields used by tstats must be indexed. Are you sure ComputerName is extracted at index-time and not at search-time?

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: tstats isn't displaying search

Path Finder

Its a custom made field. So probably at search time.... is there a way around this

0 Karma
Highlighted

Re: tstats isn't displaying search

Path Finder

or a way to find out

0 Karma
Highlighted

Re: tstats isn't displaying search

SplunkTrust
SplunkTrust

| walklex type=field index=* | stats values(field) by index will list all of your indexed fields.

---
If this reply helps you, an upvote would be appreciated.
0 Karma