Splunk Search

help on tstats command

Contributor

hello
I use the stats command below in order to count the number of index on which an host collect events

| stats dc(index) AS "Number of index" BY host 

Now I need to use stats instead tstats
So I am doing something like

| tstats dc(index) as "Number of index" 

but when I am doing this I have an error message
Error in 'TsidxStats': Aggregations are not supported for index, splunkserver and splunkserver_group"
what is the problem please???

Labels (2)
Tags (1)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

Try the following (which includes all non internal indexes and returns results from indexes you have access to):

| tstats count where index=* by host index
| stats dc(index) by host
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Try the following (which includes all non internal indexes and returns results from indexes you have access to):

| tstats count where index=* by host index
| stats dc(index) by host
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

Contributor

perfect niket! thanks

0 Karma