- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
So i have this search:
| tstats prestats=true count WHERE index=*_ot (source="*sgre*" OR o_wp="*sgre*") AND (source="*how02*" OR o_wp="*how02*") BY _indextime
| eval _time=_indextime | timechart count span=1h
Which gives me the error:
When used for 'tstats' searches, the 'WHERE' clause can contain only indexed fields. Ensure all fields in the 'WHERE' clause are indexed. Properly indexed fields should appear in fields.conf.
Anyone know the solution to this?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
index=*_ot (source="*sgre*" OR o_wp="*sgre*") AND (source="*how02*" OR o_wp="*how02*")
| stats count BY _indextime
| eval _time=_indextime
| timechart count span=1h
Or ensure all fields, e.g. o_wp are indexed fields (going forward)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @Imhim,
you can use tstats only on indexed fields, in your case o_wp shouldn't be an indexed field.
This means thatr you cannot use tstats for this search or add o_wp to the indexed fields.
or put all the fields you need for this dataset in a DataModel and use the datamodel for your search.
Ciao.
Giuseppe
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @gcusello,
Thank you.
If it needs to be an indexed field, then what would be the optimal approach to this?
Br,
Imhim
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @Imhim,
you have three choices:
- don't use tstats: if you have few events it's the easiest solution,
- add o_wp to indexed fields, it's possible following the procedure at https://docs.splunk.com/Documentation/SplunkCloud/9.0.2209/Data/Configureindex-timefieldextraction ,
- use a summary index: following the process described at https://docs.splunk.com/Documentation/Splunk/9.0.4/Knowledge/Aboutsummaryindexing ,
- create a DataModel containing all the fields you need for this search (and eventually also others) following the process at https://docs.splunk.com/Documentation/Splunk/9.0.4/Knowledge/Aboutdatamodels .
The best solution depends on your requirements: if you need performaces with many events you can use DataModels or Summary indexes.
Ciao.
Giuseppe
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you. I appreciate it
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
index=*_ot (source="*sgre*" OR o_wp="*sgre*") AND (source="*how02*" OR o_wp="*how02*")
| stats count BY _indextime
| eval _time=_indextime
| timechart count span=1h
Or ensure all fields, e.g. o_wp are indexed fields (going forward)