Splunk Search

tstats not showing results for Splunk DB Input

Explorer

I have a Splunk DataBase Input which is sending logs to Splunk by DB Connect app. I am trying to use tstats command on that input but no luck. The query, I am trying is as follows:
|tstats values(field1) values(field2) WHERE index=index1

If I use similar query on normal monitor input, I am getting results. Why I am unable to see for DB Input logs? Any idea? Thanks in advance.

Tags (2)
0 Karma

Motivator

Do you have the metadata setup on your DB connect inputs? You need to have that metadata indexed to run tstats.

Explorer

Hi @kmaron,
Yes, we have defined source, sourcetype and index for the input. I didn't enable any summary_indexing for that particular index.

0 Karma