https://community.splunk.com/t5/Splunk-Search/Why-does-tstats-not-work-with-macros-in-child-dataset/m-p/629489#M218674 <P>If you use the pivot interface and select the VPN child do you get results?</P><P>Can you try this?<BR />| tstats prestats=true summariesonly=false allow_old_summaries=true values(sourcetype) as sourcetype FROM datamodel=Authentication WHERE nodename=Authentication.VPN&nbsp;<BR />| stats dedup_splitvals=t values(sourcetype)</P> Fri, 03 Feb 2023 12:28:11 GMT diogofgm 2023-02-03T12:28:11Z https://community.splunk.com/t5/Splunk-Search/Why-does-tstats-not-work-with-macros-in-child-dataset/m-p/629474#M218669 <P>&nbsp;</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Screenshot 2023-02-03 at 13.37.51.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/23702iDECCB0C30AC2DB92/image-size/medium?v=v2&amp;px=400" role="button" title="Screenshot 2023-02-03 at 13.37.51.png" alt="Screenshot 2023-02-03 at 13.37.51.png" /></span></P> <P>I try&nbsp;use macros to get external indexes in child dataset VPN, but search with tstats on this dataset doesn't work.&nbsp; Example of search:<BR /><BR /></P> <P>&nbsp;</P> <P>&nbsp;</P> <LI-CODE lang="markup">| tstats values(sourcetype) as sourcetype from datamodel=authentication.authentication where nodename=authentication.VPN by nodename</LI-CODE> <P>&nbsp;</P> <P>&nbsp;</P> <P>&nbsp; But when<SPAN class="">&nbsp;I explicitly enumerate the indexes, then everything works! And also it work with macros when i use search:</SPAN></P> <P>&nbsp;</P> <P>&nbsp;</P> <LI-CODE lang="markup">| from datamodel ...</LI-CODE> <P>&nbsp;</P> <P>&nbsp;</P> <P><SPAN class=""><BR />What's problem?&nbsp;</SPAN></P> Fri, 03 Feb 2023 16:15:10 GMT https://community.splunk.com/t5/Splunk-Search/Why-does-tstats-not-work-with-macros-in-child-dataset/m-p/629474#M218669 kyokkygo 2023-02-03T16:15:10Z https://community.splunk.com/t5/Splunk-Search/Why-does-tstats-not-work-with-macros-in-child-dataset/m-p/629489#M218674 <P>If you use the pivot interface and select the VPN child do you get results?</P><P>Can you try this?<BR />| tstats prestats=true summariesonly=false allow_old_summaries=true values(sourcetype) as sourcetype FROM datamodel=Authentication WHERE nodename=Authentication.VPN&nbsp;<BR />| stats dedup_splitvals=t values(sourcetype)</P> Fri, 03 Feb 2023 12:28:11 GMT https://community.splunk.com/t5/Splunk-Search/Why-does-tstats-not-work-with-macros-in-child-dataset/m-p/629489#M218674 diogofgm 2023-02-03T12:28:11Z