 
					
				
		
I checked the Hunk documentation and it does not list 'tstats' as a command that's not supported, but when I try and run the following search:
| tstats count WHERE index=fwlogs by _time span=15m
I always get the message that states "No results found. Try expanding the time range", no matter what I set the time picker to (1 day, 7 days, etc).
Does tstats work in Hunk?
Thx
 
		
		
		
		
		
	
			
		
		
			
					
		Yes tstats is supported since Hunk 6.4.
Here is the link to the docs that describes what has to be done: http://docs.splunk.com/Documentation/Splunk/latest/HadoopAnalytics/Datamodelacceleration
 
		
		
		
		
		
	
			
		
		
			
					
		Yes tstats is supported since Hunk 6.4.
Here is the link to the docs that describes what has to be done: http://docs.splunk.com/Documentation/Splunk/latest/HadoopAnalytics/Datamodelacceleration
 
					
				
		
Thx for the info
