Can I fix this tstats where error?

[Imhim]

Hi, 

So i have this search: 

| tstats prestats=true count WHERE index=*_ot (source="*sgre*" OR o_wp="*sgre*") AND (source="*how02*" OR o_wp="*how02*") BY _indextime 
| eval _time=_indextime  | timechart count span=1h

Which gives me the error: 

When used for 'tstats' searches, the 'WHERE' clause can contain only indexed fields. Ensure all fields in the 'WHERE' clause are indexed. Properly indexed fields should appear in fields.conf.

Anyone know the solution to this? 

[gcusello]

Hi @Imhim,

you can use tstats only on indexed fields, in your case o_wp shouldn't be an indexed field.

This means thatr you cannot use tstats for this search or add o_wp to the indexed fields.

or put all the fields you need for this dataset in a DataModel and use the datamodel for your search.

Ciao.

Giuseppe

[Imhim]

Hi @gcusello, 

Thank you. 

If it needs to be an indexed field, then what would be the optimal approach to this? 

Br, 

Imhim 

[gcusello]

Hi @Imhim,

you have three choices:

• don't use tstats: if you have few events it's the easiest solution,
• add o_wp to indexed fields, it's possible following the procedure at https://docs.splunk.com/Documentation/SplunkCloud/9.0.2209/Data/Configureindex-timefieldextraction ,
• use a summary index: following the process described at https://docs.splunk.com/Documentation/Splunk/9.0.4/Knowledge/Aboutsummaryindexing ,
• create a DataModel containing all the fields you need for this search (and eventually also others) following the process at https://docs.splunk.com/Documentation/Splunk/9.0.4/Knowledge/Aboutdatamodels .

The best solution depends on your requirements: if you need performaces with many events you can use DataModels or Summary indexes.

Ciao.

Giuseppe

[Imhim]

Thank you. I appreciate it 

[ITWhisperer · Accepted solution]

index=*_ot (source="*sgre*" OR o_wp="*sgre*") AND (source="*how02*" OR o_wp="*how02*")
| stats count BY _indextime 
| eval _time=_indextime  
| timechart count span=1h

Or ensure all fields, e.g.  o_wp are indexed fields (going forward)