https://community.splunk.com/t5/Splunk-Search/TSTATS-with-count-zero-and-APPENDCOLS-error/m-p/498930#M138987 <P>Now i have a case:<BR /> - count call API "XXX/authen" (not session) by src_ip (1)<BR /> | tstats <CODE>summariesonly</CODE> count from datamodel=rest.rest where rest.uri="XXX/authen" by rest.src<BR /> - count session by src_ip (2)<BR /> | tstats <CODE>summariesonly</CODE> dc(rest.session) as dc_session from datamodel=rest.rest by rest.src</P> <P>I use stats with appendcols + subsearch then OK,</P> <P>index=XXX<BR /> | stats count(eval(uri="XXX/authen")) as count_uri by src<BR /> | appendcols<BR /> [search index=XXX <BR /> | stats dc(session) as dc_session by src<BR /> ]</P> <P>but use TSTATS fast, then error.<BR /> | tstats <CODE>summariesonly</CODE> count from datamodel=rest.rest where rest.uri="XXX/authen" by rest.src<BR /> | appendcols<BR /> [| tstats <CODE>summariesonly</CODE> dc(rest.session) as dc_session from datamodel=rest.rest by rest.src<BR /> ]</P> <P>Because TSTAST don't show src_ip have count zero then result of (1) , (2) are diffirent.</P> <P>Please help me!</P> Wed, 30 Sep 2020 02:29:59 GMT longnh26 2020-09-30T02:29:59Z https://community.splunk.com/t5/Splunk-Search/TSTATS-with-count-zero-and-APPENDCOLS-error/m-p/498930#M138987 <P>Now i have a case:<BR /> - count call API "XXX/authen" (not session) by src_ip (1)<BR /> | tstats <CODE>summariesonly</CODE> count from datamodel=rest.rest where rest.uri="XXX/authen" by rest.src<BR /> - count session by src_ip (2)<BR /> | tstats <CODE>summariesonly</CODE> dc(rest.session) as dc_session from datamodel=rest.rest by rest.src</P> <P>I use stats with appendcols + subsearch then OK,</P> <P>index=XXX<BR /> | stats count(eval(uri="XXX/authen")) as count_uri by src<BR /> | appendcols<BR /> [search index=XXX <BR /> | stats dc(session) as dc_session by src<BR /> ]</P> <P>but use TSTATS fast, then error.<BR /> | tstats <CODE>summariesonly</CODE> count from datamodel=rest.rest where rest.uri="XXX/authen" by rest.src<BR /> | appendcols<BR /> [| tstats <CODE>summariesonly</CODE> dc(rest.session) as dc_session from datamodel=rest.rest by rest.src<BR /> ]</P> <P>Because TSTAST don't show src_ip have count zero then result of (1) , (2) are diffirent.</P> <P>Please help me!</P> Wed, 30 Sep 2020 02:29:59 GMT https://community.splunk.com/t5/Splunk-Search/TSTATS-with-count-zero-and-APPENDCOLS-error/m-p/498930#M138987 longnh26 2020-09-30T02:29:59Z https://community.splunk.com/t5/Splunk-Search/TSTATS-with-count-zero-and-APPENDCOLS-error/m-p/498931#M138988 <P><STRONG>Anyone admin help me ??</STRONG> </P> Wed, 09 Oct 2019 04:02:17 GMT https://community.splunk.com/t5/Splunk-Search/TSTATS-with-count-zero-and-APPENDCOLS-error/m-p/498931#M138988 longnh26 2019-10-09T04:02:17Z