Splunk Search

How to count the events from domain controller server hosts per hour using tstats?

landen99
Motivator

I want to count the events from dc server hosts by hour using tstats:

| tstats count where host="srv*dc*" by host GROUPBY _time span=1h

I know that tstats is fast because it uses tsidx files with summary field data about the events for the indexed fields: _time, host, index, etc. without opening each event and looking at the _raw field. I am interested in learning how to get tstats to do this job instead of using index=_internal or | metadata so that I can understand how stats works and where it performs best.

The results of the search above are: No results found. This is true with the where clause removed as well. How can I quickly generate an hourly count of dc hosts using tstats?

0 Karma
1 Solution

MuS
Legend

Hi landen99,

take a look at the docs http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/Tstats it will tell you this:

tstats [prestats=<bool>] [local=<bool>] [append=<bool>] [summariesonly=<bool>] [allow_old_summaries=<bool>] [chunk_size=<unsigned int>] <stats-func> [ FROM ( <namespace> | sid=<tscollect-job-id> | datamodel=<datamodel-name> )] [WHERE <search-query>] [( by | GROUPBY ) <field-list> [span=<timespan>] ]

the importent part here is this:
( by | GROUPBY )

So you either can use by OR GROUPBYbut not both in one search. Try this

| tstats count where host="srv*dc*" GROUPBY _time span=1h

or

| tstats count where host="srv*dc*" by _time span=1h

hope this helps ...

cheers, MuS

View solution in original post

MuS
Legend

Hi landen99,

take a look at the docs http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/Tstats it will tell you this:

tstats [prestats=<bool>] [local=<bool>] [append=<bool>] [summariesonly=<bool>] [allow_old_summaries=<bool>] [chunk_size=<unsigned int>] <stats-func> [ FROM ( <namespace> | sid=<tscollect-job-id> | datamodel=<datamodel-name> )] [WHERE <search-query>] [( by | GROUPBY ) <field-list> [span=<timespan>] ]

the importent part here is this:
( by | GROUPBY )

So you either can use by OR GROUPBYbut not both in one search. Try this

| tstats count where host="srv*dc*" GROUPBY _time span=1h

or

| tstats count where host="srv*dc*" by _time span=1h

hope this helps ...

cheers, MuS

gaurav_maniar
Builder

Hi MuS,

I have similar query, can you please check below question,
https://answers.splunk.com/answers/770370/how-to-get-tstats-results-independent-of-time-rang.html

0 Karma

MuS
Legend

This will:

| tstats count where host="srv*dc*" by host, _time span=1h

landen99
Motivator

perfect. thank you.

0 Karma

landen99
Motivator

People should keep in mind that the where clause is for the search query. In many cases, an index needs to be specified, just as with any search query.

| tstats count where index=myindex host="srv*dc*" by host _time span=1h
0 Karma

landen99
Motivator

Will that generate hourly counts for each host?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...