How can we use tstats with TERM and PREFIX?

[danielbb]

I'm trying to run - 

| tstats count where index=wineventlog* TERM(EventID=4688) by _time span=1m

It returns no results but specifying just the term's value seems to work - 

| tstats count where index=wineventlog* TERM(4624) by _time span=1m

https://conf.splunk.com/files/2020/slides/PLA1089C.pdf explains the subject well but my simple query is not working.

[schose]

Hi @danielbb ,

It's EventCode, not EventID. 😉

| tstats count where index=wineventlog* TERM(EventCode=4688) by _time span=1m

 best regards,

Andreas

[nordinethales]

Hi danielbb,

You can try

| tstats count where index=wineventlog* TERM(EventID=*) by _time span=1m
But in the _raw event, you must have something which corresponds, like

...EventID=4624...

Then, if you want to use this EventID in the group by, you can try (be carefull The text you provide for the PREFIX() directive must be in lower case)

| tstats count where index=wineventlog* TERM(EventID=*) by PREFIX(eventid=) _time span=1m

Regards

[neelwoolies]

This is perfect. 

[danielbb]

Ok, but TERM(4624) does work. 

[richgalloway]

Which means that term is stored in a tsidx file (is indexed).

[richgalloway]

The tstats command only works with indexed fields, which usually does not include EventID.