Splunk Search

Why can't tstats search sourcetype field specifically?

hketer
Path Finder

Hi All,

I'm running the query 

| tstats count where index=<index name> by sourcetype

No results  
OR 

| tstats values(sourcetype) where index=<index name> by index

and the results for values(sourcetype) is null\empty.

I have up to date data with  no delays in indextime .

I've checked the fields.conf on indexers and I do see the field [sourcetype]

**Also there are sourcetypes that does work and I see the field 

Any ideas how to check this? or what can be the issue?

 

Thanks,
Hen

Labels (1)
0 Karma

gjanders
SplunkTrust
SplunkTrust

I tried:

| tstats values(sourcetype) where index=_internal by index

That works and | tstats count where index=_internal by sourcetype

Also works on 8.2.0

 

Did you have the time range set correctly to find data?

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...