Tagged: Diagnostics splunk on splunk tstats. Be sure to run the query over a lengthy period of time in order to include machines that haven’t sent data for sometime. This command performs statistics on the measurement, metricname, and dimension fields in metric indexes. This is a simple tstats query shows all hosts and sourcetypes that have reported data, and shows the time in seconds since anything was sent. It has no knowledge of search-time extracted fields. Description Use the mstats command to analyze metrics. The SI searches run frequently and it would be good for health of your Splunk system to run the most efficient. The standard splunk's metadata fields - host, source and sourcetype are indexed fields.īoth types of fields have their pros and cons and you usually need a very good reason to create new indexed fields.īut coming back to the original issue - doing summary statistics using tstats is possible only over indexed fields since tstats doesn't touch raw events and only uses the summaries of indexed fields. I would suggest to use tstats (if its something suitable for your requirement, considering the fact tstats only works on indexed fields, not the search time extracted fields) over stats for summary index searches. So once the event is indexed, all indexed fields possible for that event are created and written into separate files. Since your search includes only the metadata fields (index/sourcetype), you can use tstats commands like this, much faster than regular search that youd normally do to chart something like that. Those fields are created only once during the initial ingestion of events. The eventcount command just gives the count of events in the specified index, without any timestamp information. Each host and source type are corresponding. Id like to convert it to a standard month/day/year format. if i do: index stats values (host) by sourcetype. However, in using this query the output reflects a time format that is in EPOC format. Then there is the second one - the indexed fields. Im running the below query to find out when was the last time an index checked in. Since they are extracted during search time, you can modify the extraction definitions and get various fields from the same raw events, you can redefine the extractions and reapply the, to the same raw data and so on.

There are the 'usual' fields which are extracted in search time which means that splunk extracts them from raw events on the fly as it's comparing the events to your given conditions (oversimplifying slightly the process).

Tstats in splunk