topic Re: Searching from a data model using tstats, why am I getting "Error in 'TsidxStats': Invalid root event object for datamodel"? in Splunk Search

Searching from a data model using tstats, why am I getting "Error in 'TsidxStats': Invalid root event object for datamodel"?

sushmitha_mj — Thu, 16 Jul 2015 19:16:04 GMT

I created a data model "Aggregate". I added an object which is a root search object named "usage". There is a search that is written for this object which I can view when I go into the data model. I am having trouble searching from this data model.
The search I wrote:

| tstats max(Usage.field_value) from datamodel="Aggregate"

Where Usage is the root search object and Aggregate is data model name. I get the error

"Error in 'TsidxStats': Invalid root event object for datamodel "

How should I edit my search? Thanks in advance.

Re: Searching from a data model using tstats, why am I getting "Error in 'TsidxStats': Invalid root event object for datamodel"?

MuS — Thu, 16 Jul 2015 19:55:56 GMT

Hi sushmitha_mj,

did you create a root event for your data model? Data models are composed chiefly of object hierarchies built on root event objects, see the docs for more details http://docs.splunk.com/Documentation/Splunk/6.2.4/Knowledge/Designdatamodelobjects#Add_a_root_event_object_to_a_data_model

cheers, MuS

Re: Searching from a data model using tstats, why am I getting "Error in 'TsidxStats': Invalid root event object for datamodel"?

sushmitha_mj — Thu, 16 Jul 2015 20:10:22 GMT

Thank @MuS

I added a root object with a constrain and the query now works. But I get no results and no error. How do I query to access my root search output?

Re: Searching from a data model using tstats, why am I getting "Error in 'TsidxStats': Invalid root event object for datamodel"?

MuS — Thu, 16 Jul 2015 20:26:11 GMT

try this run everywhere search:

| tstats values(server.licenser.quota.gb) AS gb from datamodel=internal_server by _time

This will get you the license quota from the Splunk build in internal data model. Adopt it to your needs

Re: Searching from a data model using tstats, why am I getting "Error in 'TsidxStats': Invalid root event object for datamodel"?

sushmitha_mj — Thu, 16 Jul 2015 20:52:41 GMT

@MuS
I am getting the following error
Error in 'TsidxStats': Could not find datamodel: internal_server

Re: Searching from a data model using tstats, why am I getting "Error in 'TsidxStats': Invalid root event object for datamodel"?

MuS — Thu, 16 Jul 2015 21:02:34 GMT

Make sure, you're in the search app and have admin rights.

Re: Searching from a data model using tstats, why am I getting "Error in 'TsidxStats': Invalid root event object for datamodel"?

sushmitha_mj — Fri, 17 Jul 2015 14:52:59 GMT

@MuS
I was able to run the query | tstats values(server.licenser.quota.gb) AS gb from datamodel=internal_server by _time it gave me the Gb info against the time. Thanks