Splunk Search

"Error in 'tstats' command: This command is not supported in a real-time search"

spammenot66
Contributor

I currently have a working tstats search, but when I use real-time, it returns the following error:

Error in 'tstats' command: This command is not supported in a real-time search
0 Karma
1 Solution

woodcock
Esteemed Legend

Not only will it never work but it doesn't even make sense how it could. Use stats instead and have it operate on the events as they come in to your real-time window. Better yet, do not use real-time! It almost certainly will not give you what you desire and it will crater the performance of your splunk cluster.

View solution in original post

woodcock
Esteemed Legend

Not only will it never work but it doesn't even make sense how it could. Use stats instead and have it operate on the events as they come in to your real-time window. Better yet, do not use real-time! It almost certainly will not give you what you desire and it will crater the performance of your splunk cluster.

spammenot66
Contributor

Thanks for the info

0 Karma

somesoni2
Revered Legend

The error message explains it all. Searches with tstats can't be used for real-time searches. What is your requirement here?

Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...