topic Re: TSTATS where error in Splunk Search

TSTATS where error

jwalzerpitt — Mon, 24 Feb 2020 13:15:55 GMT

I am trying to run the following tstats search:

| tstats summariesonly=true estdc(Malware_Attacks.dest) as "infected_hosts" where "Malware_Attacks.action=allowed" from datamodel="Malware"."Malware_Attacks" 
| where 'infected_hosts'>100 
| eval const_dedup_id="const_dedup_id"

but I get the error:

Error in 'TsidxStats': WHERE clause is not an exact query

Any help would be appreciated

Thx

Re: TSTATS where error

lakshman239 — Mon, 24 Feb 2020 13:31:05 GMT

Pls change to | tstats summariesonly=true estdc(Malware_Attacks.dest) as "infected_hosts" from datamodel="Malware"."Malware_Attacks" where "Malware_Attacks.action=allowed groupby Malware_Attacks.src

Re: TSTATS where error

nickhills — Mon, 24 Feb 2020 13:42:35 GMT

it's "from where", as opposed to "where from"
Thus:
| tstats summariesonly=true estdc(Malware_Attacks.dest) as "infected_hosts" from datamodel="Malware"."Malware_Attacks" where "Malware_Attacks.action"=allowed

Re: TSTATS where error

jwalzerpitt — Mon, 24 Feb 2020 14:03:46 GMT

That was it - TYVM

Re: TSTATS where error

nickhills — Wed, 26 Feb 2020 21:54:59 GMT

If my answer helped, please consider accepting and/or upvoting so that other memebers of the community can see it was useful.

I have the same error "Error in 'TsidxStats': WHERE clause is not an exact query"

OsmanElyas — Mon, 24 Jul 2023 07:16:46 GMT

| tstats summariesonly=true sum(log.bytes) as MBytes_transferred from datamodel="ftnt_fos" where nodename="log.traffic" $srcip$ $dstip$ $user$ $app$ $vdom$ $device$ $srcintf$ $dstintf$ groupby log.user | eval MBytes_transferred = (MBytes_transferred/(1024*1024)) | sort -MBytes_transferred | head 10