Splunk Search

How to add a non existing field in tstats command?

whitefang1726
Path Finder

Hello, 

I looking for options to add a non-existing field in tstats command. The scenario is the field doesn't exist. Normally I create regex for searches, however, it doesn't work similar with tstats.

Example Query:

index=something sourcetype=something:something
| rex field=source".....(?<new_field>[0-9A-Z]+)"

This command will create new_field  field based on source field.

For tstats, the idea should be.. 

| tstats count max(_time) as _time where ....

 

 

Is this possible? Sorry for the lack of details.

Labels (1)
0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@whitefang1726 - It depends. If all the fields you need are indexed fields then yes you can do it.

For example, you just need to count by new_field extracted from source then you can use something like below query:

| tstats count where index=something sourcetype=something:something by source
| rex field=source ".....(?<new_field>[0-9A-Z]+)"
| stats sum(count) as count by new_field

 

I hope this helps!!

0 Karma

venkatasri
SplunkTrust
SplunkTrust

tstats only for indexed fields. rex is a search-time.

Refer - https://docs.splunk.com/Documentation/Splunk/8.2.5/Data/Configureindex-timefieldextraction

after successful creation you can use the field in tstats.

--

Hope it helps!

Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...