Splunk Search

Tstats events restriction / from command time range

astatrial
Contributor

Hi all,
I have a bit complicated question.

I tried to use "tstats count" command to check if there are events in a DM and because of the time range, the query took very long (a lot of events exist in the DM). I couldn't find any way to stop the tstats when the command finds even 1 event, except for head, which is not useful because it only affect when tstats is done.

So, I changed it to a from command, with head but the problem with that was to configure time range from within the query (as done with tstats "where earliest "...)

Can anyone help me find a way to stop tstats after it reach to specific count, or alternatively to use from with time range (within the query).

I am really out of ideas regarding to this...

Thanks a lot!!

0 Karma
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...