Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Search
Splunk Community
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Search
Search
Search the Community
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
2,000 results
Sort by:
01-26-2024
10:33 AM
My current search is - | tstats count AS event_count WHERE index=* BY host, _time span=1h | append [ | inputlookup Domain_Computers | fields cn, operatingSystem, o...
12-08-2023
05:36 AM
Hello Team, Everyone has probably seen this error. Error in 'TsidxStats': _time aggregations are not yet supported except for count/min/max/range/earliest/latest I try to understand stats co...
Labels
- Labels:
-
distributed search
06-08-2023
12:39 AM
Hi,
So i have this search:
| tstats prestats=true count WHERE index=*_ot (source="*sgre*" OR o_wp="*sgre*") AND (source="*how02*" OR o_wp="*how02*") BY _...
Labels
- Labels:
-
tstats
Show results in replies (5)
-
index=*_ot (source="*sgre*" OR o_wp="*sgre*") AND (source="*how02*" OR o_wp="*how02*") | stats coun...
-
Hi @Imhim, you can use tstats only on indexed fields, in your case o_wp shouldn't be an i...
-
Hi @gcusello, Thank you. If it needs to be an indexed field, then what would be ...
-
Hi @Imhim, you have three choices: don't use tstats: if you have few events it's the e...
-
Thank you. I appreciate it
10-12-2017
03:34 AM
I am trying to do a time chart of available indexes in my environment , I already tried below query with no luck
| tstats count where index=* by index _time
but i want results in the same f...
without-tstats.png (1 KB)
with-tstats.png (1 KB)
05-16-2024
05:40 AM
We've run into a few occassions where one of our network devices stops sending logs to Splunk. I have a tstats search based on the blog post here: https://www.splunk.com/en_us/blog/tips-and-t...
Labels
- Labels:
-
alert condition
10-29-2024
12:11 PM
We are ingesting large volume of network data and would like to use tstats to make the searches faster. The query index=myindex is returning results as expected, but when I run a b...
03-22-2023
06:29 AM
I am wondering why tstats command alters time stamps when I run it by _time.
| tstats values(text_len) as text_len values(ts) as ts where index = data sourcetype = cdr by _time t...
- Tags:
- tstats
Labels
- Labels:
-
tstats
Show results in replies (6)
-
To group events by _time, tstats rounds the _time value down to create groups based on the s...
-
I ran into the same thing, but I noticed that when I run my queries against a data model that is no...
-
This thread is more than a year old so you are more likely to get responses by submitting a new que...
-
tstats still would have modified the timestamps in anticipation of creating groups. It w...
-
Hi @richgalloway Thank you for your response. But in my case there are no group...
-
...ut as a field value, e.g. | tstats max(_time) AS _time values(text_len) as text_len values(t...
08-05-2024
12:15 PM
For some reason my |tstats count query is returning a result of 0 when I add an OR condition in my where clause if the field doesn't exist in the dataset, or if the OR condition specifies a...
Labels
- Labels:
-
tstats
Show results in replies (6)
-
Hi @ciphercloudops tstats command works only with indexed fields. Default indexed f...
-
...ble to use tstats to query on any of our JSON fields that I've tried, for example returns the c...
-
Hi @chrislkt | tstats only searches the indexed fields in tsidx files. All f...
-
First, OR operator is certainly usable in tstats. Try this: | tstats count values(s...
-
...e upgraded from Splunk 8.x to 9.x a couple months ago. To further illustrate: |tstats count where i...
-
Splunk support confirmed this is a bug in 9.1.0.2. Based on the SPL, it has been resolved in Beryll...
08-20-2024
10:43 AM
What is the best approach for data visualization using tstats? I am new to using tstats, I moved away from using the regular search index because it speeds up the query process. for example m...
Labels
- Labels:
-
Dashboard Studio
-
drilldown
-
panel
-
token
