We are ingesting large volume of network data and would like to use tstats to make the searches faster.
The query
index=myindex
is returning results as expected, but when I run a basic tstats like
| tstats count where index=myindex
returns zero results. What could be the cause?
Attempted also to use :
| tstats count where index=federated:myindex
but it did not help.
Start diagnosis with this:
| tstats count where index=* by index
Is "myindex" in the list?
Start diagnosis with this:
| tstats count where index=* by index
Is "myindex" in the list?
thank you, that is a useful query