Greetings,
So, I want to use the tstats
command. It's super fast and efficient. But not if it's going to remove important results. Any record that happens to have just one null value at search time just gets eliminated from the count. That's important data to know.
With classic search I would do this:
index=* mysearch=*
| fillnull value="null" field1 field2 (etc...)
| stats count by field1 field2 (etc...)
with this, I see my events, and if one shows up as "null" in a couple fields, well, I know it was empty!
Can this be accomplished with the tstats
command? Thank you so much.
Sincerely,
A want-to-be tstats advocate
@chris94089
Can you please try this?
|tstats count values(field1) as field1 values(field2) as field2 where index=YOUR_INDEX by _time | fillnull field1 field2 value="NULL" | stats sum(count) as count by field1 field2
My Sample Search:
|tstats count values(component) as component where index=_internal by _time index | fillnull component value="NULL" | stats sum(count) as count by component
Thanks
Hi @kamlesh_vaghela,
It looks like only those fields we can use with tstats which is extracted at time of indexing, as I am running walklex
on _internal index bucket and I can see component
field in tsidx file so we can use that in tstats but not other fields like bytes
from _internal index with above query (If we use datamodel then we can definitely use that 🙂 but without datamodel I think tstats limits with only fields which are extracted at index time)