Splunk Search

help on tstats command

jip31
Motivator

hello
I use the stats command below in order to count the number of index on which an host collect events

| stats dc(index) AS "Number of index" BY host 

Now I need to use stats instead tstats
So I am doing something like

| tstats dc(index) as "Number of index" 

but when I am doing this I have an error message
Error in 'TsidxStats': Aggregations are not supported for index, splunk_server and splunk_server_group"
what is the problem please???

Labels (2)
Tags (1)
0 Karma
1 Solution

niketn
Legend

Try the following (which includes all non internal indexes and returns results from indexes you have access to):

| tstats count where index=* by host index
| stats dc(index) by host
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketn
Legend

Try the following (which includes all non internal indexes and returns results from indexes you have access to):

| tstats count where index=* by host index
| stats dc(index) by host
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

jip31
Motivator

perfect niket! thanks

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...