Splunk Search
×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question

Tstats events restriction / from command time range

astatrial
Contributor
‎05-19-2019 05:43 AM

Hi all,
I have a bit complicated question.

I tried to use "tstats count" command to check if there are events in a DM and because of the time range, the query took very long (a lot of events exist in the DM). I couldn't find any way to stop the tstats when the command finds even 1 event, except for head, which is not useful because it only affect when tstats is done.

So, I changed it to a from command, with head but the problem with that was to configure time range from within the query (as done with tstats "where earliest "...)

Can anyone help me find a way to stop tstats after it reach to specific count, or alternatively to use from with time range (within the query).

I am really out of ideas regarding to this...

Thanks a lot!!

0 Karma
Reply
Get Updates on the Splunk Community!

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

 Prepare to elevate your security operations with the powerful upgrade to Splunk Enterprise Security 8.x! This ...

Get Early Access to AI Playbook Authoring: Apply for the Alpha Private Preview ...

Passionate about security automation? Apply now to our AI Playbook Authoring Alpha private preview ...

Reduce and Transform Your Firewall Data with Splunk Data Management

Managing high-volume firewall data has always been a challenge. Noisy events and verbose traffic logs often ...