What is the difference between `tstats` and tstats?

thom_larner — Mon, 18 Apr 2016 07:17:07 GMT

Hi all,

I'm trying to build a simple dashboard that shows a simple graph of bytes sent by a web server. I realize that I want to use the "Web" accelerated data model, or the searches will take a long time.

After looking at the "Web Center" dashboard, and some tinkering, I arrived at this search:

| `tstats` sum(Web.bytes) from datamodel=Web by _time | timechart sum(Web.bytes)

This search works a treat, and runs very quickly. However, the output shows the raw byte count, which is hard to read. I would like to output Gb instead. So, after some more tinkering, I arrived at this search:

| tstats sum("Web.bytes") as "total_bytes" FROM datamodel=Web by _time | timechart eval(sum(total_bytes)/(1024*1024*1024)) as "GB out"

This search shows exactly what I want, but runs very slowly. It seems that the difference is `tstats` vs tstats, i.e. quotes vs. no quotes. If I remove the quotes from the first search, then it runs very slowly. And if I add the quotes to the second search, it runs much faster, but no results are found, so it seems that `tstats` has different semantics when it comes to applying functions such as eval.

So I have two questions, the first being about the difference between `tstats` and tstats, and why there is such a big performance difference. The second question is why `tstats` seems to not have some functions available.

I realize I'm probably missing something really obvious!

Thanks for your help.

Cheers,

Thom.

Re: What is the difference between `tstats` and tstats?

richgalloway — Mon, 18 Apr 2016 17:50:08 GMT

A name within backticks is a macro. You should be able to find the definition of the macro at Settings->Advanced Search->Search macros.

topic What is the difference between `tstats` and tstats? in Splunk Search

What is the difference between `tstats` and tstats?

Re: What is the difference between `tstats` and tstats?