Splunk Search

Tstats events restriction / from command time range


Hi all,
I have a bit complicated question.

I tried to use "tstats count" command to check if there are events in a DM and because of the time range, the query took very long (a lot of events exist in the DM). I couldn't find any way to stop the tstats when the command finds even 1 event, except for head, which is not useful because it only affect when tstats is done.

So, I changed it to a from command, with head but the problem with that was to configure time range from within the query (as done with tstats "where earliest "...)

Can anyone help me find a way to stop tstats after it reach to specific count, or alternatively to use from with time range (within the query).

I am really out of ideas regarding to this...

Thanks a lot!!

0 Karma