topic Re: Accelerated data model and _indextime field in Reporting

Accelerated data model and _indextime field

simpkins1958 — Wed, 30 Sep 2020 01:54:39 GMT

We have an accelerated data model and would like to be able to use a where clause from TSTATS that includes:

_index_earliest=-h@h AND _index_latest=@h

_indextime does seem to be a field that is available in the DMA. But trying to use the where clause above does not work.

We want to generate TSTATS values for events that have been indexed in the previous hour.

Here is the full SPL:
| tstats
min(_time) as _time
sum(nmds_app_dest_survey.bytes) as bytes
sum(nmds_app_dest_survey.flow_count) as flow_count
FROM datamodel=nmdm_app_dest_survey
WHERE _index_earliest=-h@h AND _index_latest=@h
BY nmds_app_dest_survey.dest_and_port

Re: Accelerated data model and _indextime field

Sukisen1981 — Wed, 30 Sep 2020 01:54:40 GMT

if you switch this to |tstats _index_earliest=-h@h AND _index_latest=@h
and remove the where condition, does it work?

Re: Accelerated data model and _indextime field

simpkins1958 — Wed, 30 Sep 2020 01:54:43 GMT

No. That does not work either.
Error in 'stats' command: The argument '_index_earliest=-h@h' is invalid.

Re: Accelerated data model and _indextime field

ninjaunicorn101 — Fri, 24 Jan 2020 20:09:38 GMT

@simpkins1958 did you ever get this to work? I am currently running into the same problem.

Re: Accelerated data model and _indextime field

cstump_splunk — Fri, 10 Apr 2020 20:24:07 GMT

At this time _indextime fields are not included in the datamodel accelerations. I imagine this is due to optimization with regards to both disk space and memory usage during the acceleration process.

If you are interested in having a field that tracks the time the accelerated event gets written to disk, then I encourage you to submit the idea to the ideas portal at https://ideas.splunk.com/.

Re: Accelerated data model and _indextime field

samsplunks — Fri, 02 Oct 2020 13:20:48 GMT

Why don't you add a new field to your datamodel and assign it the _indextime value ?

Re: Accelerated data model and _indextime field

GreenFish — Wed, 24 Apr 2024 19:50:18 GMT

| tstats count WHERE index=_internal _index_earliest=-1h _index_latest=now

Just set your time range for the search to be greater than the expected delay

* earliest_time = -1d@d
* latest_time = +60d@d