Hi All,
I'm running the query
| tstats count where index=<index name> by sourcetype
No results
OR
| tstats values(sourcetype) where index=<index name> by index
and the results for values(sourcetype) is null\empty.
I have up to date data with no delays in indextime .
I've checked the fields.conf on indexers and I do see the field [sourcetype]
**Also there are sourcetypes that does work and I see the field
Any ideas how to check this? or what can be the issue?
Thanks,
Hen
I tried:
| tstats values(sourcetype) where index=_internal by index
That works and | tstats count where index=_internal by sourcetype
Also works on 8.2.0
Did you have the time range set correctly to find data?