Splunk Search

tstats returning zero results for a simple count query

imrago
Contributor

We are ingesting large volume of network data and would like to use tstats to make the searches faster. 

The query 

index=myindex

is returning results as expected, but when I run a basic tstats like

| tstats count where index=myindex

returns zero results. What could be the cause?

 

Attempted also to use :

| tstats count where index=federated:myindex

but it did not help.

 

Labels (2)
0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

Start diagnosis with this:

| tstats count where index=* by index

Is "myindex" in the list?

View solution in original post

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Start diagnosis with this:

| tstats count where index=* by index

Is "myindex" in the list?

0 Karma

imrago
Contributor

thank you, that is a useful query

0 Karma
Get Updates on the Splunk Community!

New Year. New Skills. New Course Releases from Splunk Education

A new year often inspires reflection—and reinvention. Whether your goals include strengthening your security ...

Splunk and TLS: It doesn't have to be too hard

Overview Creating a TLS cert for Splunk usage is pretty much standard openssl.  To make life better, use an ...

Faster Insights with AI, Streamlined Cloud-Native Operations, and More New Lantern ...

Splunk Lantern is a Splunk customer success center that provides practical guidance from Splunk experts on key ...