Splunk Search

How to convert my two searches into tstats searches?

Robel206
New Member

Hey everyone,

I need a little assistance converting these 2 searches (one is a pivot search) I have into tstats searches.

  1. | pivot Expweb_Tracelog_Service Service_Events count(Service_Events) AS "Count of Service_Events" SPLITROW _time AS _time PERIOD auto SPLITCOL eventName FILTER eventName is service:SoftvoyageService* FILTER success is false SORT 100 _time ROWSUMMARY 0 COLSUMMARY 0 NUMCOLS 100 SHOWOTHER 1

  2. index = exp sourcetype = expwebtracelog splunk_server_group = ewe host = cheXwbtexweb10* eventName=service:SoftvoyageService* OR eventName=ThreePP* | stats count AS Total count(eval(success="true")) AS Successful count(eval(success="false")) AS Failed by eventName | eval "SuccessPercent"=(Total-Failed)/Total*100

Thanks,

0 Karma
1 Solution

jplumsdaine22
Influencer

You'll only be able to use tstats if the fields are indexed. By default, that is host, source, sourcetype and _time. If eventName and success are search time fields then you will not be able to use tstats.

You can quickly check by running the following search

| tstats count WHERE sourcetype = expwebtracelog (eventName=* OR success=*) by eventName,success

If you get no results then these are not indexed fields.

If your data model is accelerated you might be able to use tstats for your first query, try

| tstats prestats=t count(Service_Events)  WHERE eventName=service:SoftvoyageService* AND success=false FROM Expweb_Tracelog_Service Service_Events by _time | timechart AS count(Service_Events) "Count of Service_Events" | head 100

View solution in original post

0 Karma

jplumsdaine22
Influencer

You'll only be able to use tstats if the fields are indexed. By default, that is host, source, sourcetype and _time. If eventName and success are search time fields then you will not be able to use tstats.

You can quickly check by running the following search

| tstats count WHERE sourcetype = expwebtracelog (eventName=* OR success=*) by eventName,success

If you get no results then these are not indexed fields.

If your data model is accelerated you might be able to use tstats for your first query, try

| tstats prestats=t count(Service_Events)  WHERE eventName=service:SoftvoyageService* AND success=false FROM Expweb_Tracelog_Service Service_Events by _time | timechart AS count(Service_Events) "Count of Service_Events" | head 100
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...