help on tstats command

[jip31]

hello
I use the stats command below in order to count the number of index on which an host collect events

| stats dc(index) AS "Number of index" BY host 

Now I need to use stats instead tstats
So I am doing something like

| tstats dc(index) as "Number of index" 

but when I am doing this I have an error message
Error in 'TsidxStats': Aggregations are not supported for index, splunk_server and splunk_server_group"
what is the problem please???

[niketn · Accepted solution]

Try the following (which includes all non internal indexes and returns results from indexes you have access to):

| tstats count where index=* by host index
| stats dc(index) by host

[jip31]

perfect niket! thanks