hello
I use the stats command below in order to count the number of index on which an host collect events
| stats dc(index) AS "Number of index" BY host
Now I need to use stats instead tstats
So I am doing something like
| tstats dc(index) as "Number of index"
but when I am doing this I have an error message
Error in 'TsidxStats': Aggregations are not supported for index, splunk_server and splunk_server_group"
what is the problem please???
Try the following (which includes all non internal indexes and returns results from indexes you have access to):
| tstats count where index=* by host index
| stats dc(index) by host
Try the following (which includes all non internal indexes and returns results from indexes you have access to):
| tstats count where index=* by host index
| stats dc(index) by host
perfect niket! thanks