topic Error when trying to search Network Traffic data model with tstats in Splunk Search

Error when trying to search Network Traffic data model with tstats

jwalzerpitt — Wed, 23 Sep 2020 18:24:57 GMT

I am trying to search the Network Traffic data model, specifically blocked traffic, as follows:

| tstats summariesonly=true allow_old_summaries=true count from datamodel="Network_Traffic"."All_Traffic"."Traffic_By_Action"."Blocked_Traffic"

and I get the following error:

Error in 'DataModelCache': Invalid or unaccelerable root object for datamodel

Am I not chaining the child objects correctly in the search?

Thx

Re: Error when trying to search Network Traffic data model with tstats

richgalloway — Wed, 23 Sep 2020 20:08:15 GMT

The datamodel keyword takes only the root datamodel name. To specify a dataset within the DM, use the nodename option. See https://docs.splunk.com/Documentation/Splunk/8.0.6/SearchReference/Tstats#:~:text=indicating,model

| tstats summariesonly=true allow_old_summaries=true count from datamodel="Network_Traffic" where nodename="All_Traffic"."Traffic_By_Action"."Blocked_Traffic"

Re: Error when trying to search Network Traffic data model with tstats

jwalzerpitt — Thu, 24 Sep 2020 13:05:42 GMT

@richgalloway

Thx for the reply and the info.

When I ran the query

| tstats summariesonly=true allow_old_summaries=true count from datamodel="Network_Traffic" WHERE nodename="All_Traffic"."Traffic_By_Action"."Blocked_Traffic"

I got the following error: Error in 'TsidxStats': WHERE clause is not an exact query

Thx

Re: Error when trying to search Network Traffic data model with tstats

jwalzerpitt — Thu, 24 Sep 2020 15:05:46 GMT

Figured out the issue after banging away for a little - I had to drop the quotes from the nodenames

| tstats summariesonly=true allow_old_summaries=true count from datamodel="Network_Traffic" WHERE nodename=All_Traffic.Traffic_By_Action.Blocked_Traffic BY _time span=1h