https://community.splunk.com/t5/Splunk-Dev/How-to-leverage-the-data-from-tstats-query-from-a-datamodel-to/m-p/414010#M7172 <P>I am using C#SDK to search for <CODE>| tstats count FROM datamodel=IIS_Data WHERE nodename=IIS_events IIS_events.cs_method='GET'....</CODE> but it is failing with "Error in 'tstats' command: This command is not supported in a real-time search".</P> <P>If we replace tstats with stats and what else we need to make change?</P> Wed, 17 Jun 2020 23:12:10 GMT kaur_aman18 2020-06-17T23:12:10Z https://community.splunk.com/t5/Splunk-Dev/How-to-leverage-the-data-from-tstats-query-from-a-datamodel-to/m-p/414010#M7172 <P>I am using C#SDK to search for <CODE>| tstats count FROM datamodel=IIS_Data WHERE nodename=IIS_events IIS_events.cs_method='GET'....</CODE> but it is failing with "Error in 'tstats' command: This command is not supported in a real-time search".</P> <P>If we replace tstats with stats and what else we need to make change?</P> Wed, 17 Jun 2020 23:12:10 GMT https://community.splunk.com/t5/Splunk-Dev/How-to-leverage-the-data-from-tstats-query-from-a-datamodel-to/m-p/414010#M7172 kaur_aman18 2020-06-17T23:12:10Z https://community.splunk.com/t5/Splunk-Dev/How-to-leverage-the-data-from-tstats-query-from-a-datamodel-to/m-p/414011#M7173 <P>Not familiar with the C# SDK and not sure what exactly you want to achieve, but can you not just run it as a normal search instead of a realtime search? Doing realtime searches on an accelerated data model anyway doesn't make much sense.<BR /> See <A href="https://dev.splunk.com/view/csharp-sdk-pcl/SP-CAAAEYY">https://dev.splunk.com/view/csharp-sdk-pcl/SP-CAAAEYY</A> for the differences and how to run them.</P> Wed, 12 Jun 2019 13:57:29 GMT https://community.splunk.com/t5/Splunk-Dev/How-to-leverage-the-data-from-tstats-query-from-a-datamodel-to/m-p/414011#M7173 FrankVl 2019-06-12T13:57:29Z