topic Why is tstats not working on docker image datasets? in Splunk Search

Why is tstats not working on docker image datasets?

joniba — Tue, 05 Sep 2023 19:46:20 GMT

I'm totally and utterly new to splunk. Just ran the dockerhub sample, and followed the instructions: https://hub.docker.com/r/splunk/splunk/

I opened the search tab and most search commands seem to work fine. For example, the following command:

| from datamodel:"internal_server.server" | stats count

Returns a count of 33350.

While this command:

| tstats count from datamodel:"internal_server.server"

as well as this one:

| tstats count

both return zero.

How can I get tstats working in this docker env with the sample datasets?

Re: Why is tstats not working on docker image datasets?

PickleRick — Tue, 05 Sep 2023 20:36:39 GMT

I don't know what dataset you're working with but the first thing that comes to mind is that your datamodel is not accelerated. If you don't have accelerated summaries, tstats has nothing to operate on.

And it's completely irrelevant if it's a docker image, VM or bare metal install.

Re: Why is tstats not working on docker image datasets?

joniba — Wed, 06 Sep 2023 10:25:40 GMT

Hey @PickleRick , I went into the settings for the dataset and enabled acceleration (via Edit Acceleration). Also the dataset shows up as accelerated in the list of datasets. Shouldn't that have resolved the issue?

Also, why do you say it's irrelevant on a docker image? Is it not supposed to work on docker?

Do you know of any documentation describing this?

Re: Why is tstats not working on docker image datasets?

PickleRick — Wed, 06 Sep 2023 10:54:29 GMT

OK. The tstats command has a bit different way of specifying dataset than the from command.

So you should be doing

| tstats count from datamodel=internal_server.server

And it's irrelevant whether it's a docker container or any other way of deploying Splunk because the commands work the same way regardless of how the software is deployed.