Please enable JavaScript.
Coggle requires JavaScript to display documents.
tstats (tstats large scale (focus on get data part --splunkd limitation) …
tstats
-
-
FROM Nomal index
-
options
-
-
prestats=true (remote) Specifies whether to use the prestats format. When prestats=true, AS instructions are not relevant. The field names for the aggregates are determined by the command that consumes the prestats format and produces the aggregate output. Default: false
-
-
by
-
-
filed list( Specify a raw segment in your indexed events that you want to split by as if it were an extracted field-value pair.)
-
-
-
-
-