topic Re: TsidxStats Error after Splunk v8 Upgrade in Splunk Enterprise

TsidxStats Error after Splunk v8 Upgrade

afx — Mon, 06 Jul 2020 12:00:20 GMT

I just upgraded from 7.2.4 to 8.0.4.1

So far everything seems to be OK apart from two data models.

Web still works, but Authentication and Change(Account) both report the following error:

Error in 'TsidxStats': A field for an aggregate function is missing or invalid. Aggregate functions require fields with valid values to complete their arguments.

This for even the simplest query, like

| tstats values from datamodel=Authentication

Unfortunately I see no further explanation or hints in the search log.

Any ideas on how to get this fixed?

thx
afx

Re: TsidxStats Error after Splunk v8 Upgrade

anilchaithu — Mon, 06 Jul 2020 13:41:23 GMT

@afx

the syntax should be

| tstats values(field_name) from datamodel=authentication

The error is also pointing the same i.e. missing field name

Re: TsidxStats Error after Splunk v8 Upgrade

afx — Mon, 06 Jul 2020 13:47:46 GMT

Thanks!

interesting that this worked in v7. I always thought I had to have a values without field to get any data at all from the model.

thx
afx

Re: TsidxStats Error after Splunk v8 Upgrade

the_wolverinie — Wed, 13 Oct 2021 22:34:48 GMT

I always wondered why that old syntax even worked. Turns out it should NOT have worked!