Splunk Search

Is tstats supposed to work with fields that contain period characters?

woodcock
Esteemed Legend

I just discovered that indexed fields with periods in them are not tstatsable in my 7.2.1 environment. Is this a known thing? Is it a bug?

For those who would like to play along, if you have INDEXED_EXTRACTIONS = json events, then you surely have some index-time fields with periods in them. First find them:

index=foo AND sourcetype=json AND index.field.with.periods=*

Then verify that it is index-time like this (it should also return events; if not, then index.field.with.periods is not index-time).

index=foo AND sourcetype=json AND index.field.with.periods::*

Then test for fail like this:

|tstats first("index.field.with.periods") AS this_should_work_but_will_not WHERE index=foo AND sourcetype=json
0 Karma

chrisyounger
SplunkTrust
SplunkTrust

This works fine for me. Did you just forget your leading pipe in the answers question? Interestingly, using single quotes doesnt work. But no quotes or double quotes works.

alt text

woodcock
Esteemed Legend

I edited and added the pipe. What version of Splunk (Search Head and Indexers)?

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

Yes it does. ver 7.2.0

alt text

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...