Splunk Search

tstats returning zero results for a simple count query

imrago
Contributor

We are ingesting large volume of network data and would like to use tstats to make the searches faster. 

The query 

index=myindex

is returning results as expected, but when I run a basic tstats like

| tstats count where index=myindex

returns zero results. What could be the cause?

 

Attempted also to use :

| tstats count where index=federated:myindex

but it did not help.

 

Labels (2)
0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

Start diagnosis with this:

| tstats count where index=* by index

Is "myindex" in the list?

View solution in original post

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Start diagnosis with this:

| tstats count where index=* by index

Is "myindex" in the list?

0 Karma

imrago
Contributor

thank you, that is a useful query

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...