Hmmm...this throws error expecting a namespace ...tsidxstats error...missing "FROM" keyword to specify namespace
does this work against indexes ? above error suggests it runs only against tsidxstats of tscollect
yes on splunk 5.0.4 unfortunately...is there some way we can do the same ? i just need to find the latest time each host has logged using metadata but also output what index it belongs to ...
tstats can do with indexes can be done with stats:
index=* | stats latest(_time) latest(_indextime) count by host index
However, that may be slow, very slow, or glacial. You can of course speed things up by running this query regularly over a short timerange and storing the data in a lookup: http://blogs.splunk.com/2011/01/11/maintaining-state-of-the-union/
_indextime should be about twice as fast as regular
stats... if your forwarders basically send current data then you could get along with using
_time as a workaround.
Thanks ... unless i misundertood something recenttime is indextine for metaseach on hosts ...but metasearch do not output the index names on which they run...i need to be able to read the results to act on it and it needs to have the index name...