Splunk Search

How to add a non existing field in tstats command?

whitefang1726
Path Finder

Hello, 

I looking for options to add a non-existing field in tstats command. The scenario is the field doesn't exist. Normally I create regex for searches, however, it doesn't work similar with tstats.

Example Query:

index=something sourcetype=something:something
| rex field=source".....(?<new_field>[0-9A-Z]+)"

This command will create new_field  field based on source field.

For tstats, the idea should be.. 

| tstats count max(_time) as _time where ....

 

 

Is this possible? Sorry for the lack of details.

Labels (1)
0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@whitefang1726 - It depends. If all the fields you need are indexed fields then yes you can do it.

For example, you just need to count by new_field extracted from source then you can use something like below query:

| tstats count where index=something sourcetype=something:something by source
| rex field=source ".....(?<new_field>[0-9A-Z]+)"
| stats sum(count) as count by new_field

 

I hope this helps!!

0 Karma

venkatasri
SplunkTrust
SplunkTrust

tstats only for indexed fields. rex is a search-time.

Refer - https://docs.splunk.com/Documentation/Splunk/8.2.5/Data/Configureindex-timefieldextraction

after successful creation you can use the field in tstats.

--

Hope it helps!

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...