topic help on tsats command with datamodel in Splunk Search

help on tsats command with datamodel

jip31 — Mon, 30 Oct 2023 07:04:40 GMT

I have created a basic datamodel called "TEST"

I try to query on this datamodel with tstats but the only piece of code which return value is :

| tstats count from datamodel=TEST

But i cant se the events related to this request

And if i try to be more explicit in my request like below, I have no results

| tstats count from datamodel=TEST where EventCode=100

So what is the problem?

Other question : what is the interest to use datamodel and pivot command since it's possible to query on a datamodel without SPL?

Thanks

Re: help on tsats command with datamodel

gcusello — Mon, 30 Oct 2023 07:19:04 GMT

Hi @jip31,

as you can read at https://docs.splunk.com/Documentation/Splunk/9.1.1/Knowledge/Aboutdatamodels , data models are tables containing the fields extracted from your events, but yu don't have the events, so youcannot see then in search results.

Data models are very useful because they are very fast in searching for fields.

they have a very fixed syntax in the order of options (as oter Splunk commands) so you have to put exactly the option in the required order.

Then when you use data model fields, you have to remember to use the datamodel name, so, in in your TEST datamodel you have the EventCode field, you have to use:

| tstats count from datamodel=TEST where TEST.EventCode=100

Datamodel are very important when you have structured data to have very fast searches on large amount of data.

Ciao.

Giuseppe

Re: help on tsats command with datamodel

jip31 — Mon, 30 Oct 2023 08:29:58 GMT

Hi Gcusello

I can see the fields extracted in my datamodel

And even if i use your search below I have no results

| tstats count from datamodel=TEST where TEST.EventCode=100

I have only results heriteld fields like host, sourcetype, source

Re: help on tsats command with datamodel

gcusello — Mon, 30 Oct 2023 08:35:07 GMT

Hi @jip31,

are you sure that data are in your datamodel?

test this using pivot.

Ciao.

Giuseppe

Re: help on tsats command with datamodel

jip31 — Mon, 30 Oct 2023 13:04:02 GMT

it seems to be

I have also the message Datamodel 'TEST' had an invalid search, cannot get indexes to search