https://community.splunk.com/t5/Splunk-Search/Why-are-data-model-metrics-not-showing-up-with-this-search/m-p/291818#M88138 <P>The following searches work : </P> <PRE><CODE>| tstats `xxxx_summaries_only` avg(All_Performance.Memory.swap_free) AS swap_free FROM datamodel=COY_Performance WHERE nodename="All_Performance.Memory" AND All_Performance.dest="hostname-11" | tstats `xxxx_summaries_only` avg(All_Performance.Memory.swap) AS swap FROM datamodel=COY_Performance WHERE nodename="All_Performance.Memory" AND All_Performance.dest="hostname-11" </CODE></PRE> <P>This doesn’t work</P> <PRE><CODE>| tstats `xxxx_summaries_only` avg(All_Performance.Memory.swap_used) AS swap_used FROM datamodel=COY_Performance WHERE nodename="All_Performance.Memory" AND All_Performance.dest="hostname-11" </CODE></PRE> <P>But via the pivot on the datamodel, I do see metrics from "All_Performance.Memory.swap_used". </P> <P>Any reason why my search returns nothing for </P> <PRE><CODE>| tstats `xxxx_summaries_only` avg(All_Performance.Memory.swap_used) AS swap_used FROM datamodel=COY_Performance WHERE nodename="All_Performance.Memory" AND All_Performance.dest="hostname-11" </CODE></PRE> Tue, 29 Sep 2020 12:48:44 GMT locose 2020-09-29T12:48:44Z https://community.splunk.com/t5/Splunk-Search/Why-are-data-model-metrics-not-showing-up-with-this-search/m-p/291818#M88138 <P>The following searches work : </P> <PRE><CODE>| tstats `xxxx_summaries_only` avg(All_Performance.Memory.swap_free) AS swap_free FROM datamodel=COY_Performance WHERE nodename="All_Performance.Memory" AND All_Performance.dest="hostname-11" | tstats `xxxx_summaries_only` avg(All_Performance.Memory.swap) AS swap FROM datamodel=COY_Performance WHERE nodename="All_Performance.Memory" AND All_Performance.dest="hostname-11" </CODE></PRE> <P>This doesn’t work</P> <PRE><CODE>| tstats `xxxx_summaries_only` avg(All_Performance.Memory.swap_used) AS swap_used FROM datamodel=COY_Performance WHERE nodename="All_Performance.Memory" AND All_Performance.dest="hostname-11" </CODE></PRE> <P>But via the pivot on the datamodel, I do see metrics from "All_Performance.Memory.swap_used". </P> <P>Any reason why my search returns nothing for </P> <PRE><CODE>| tstats `xxxx_summaries_only` avg(All_Performance.Memory.swap_used) AS swap_used FROM datamodel=COY_Performance WHERE nodename="All_Performance.Memory" AND All_Performance.dest="hostname-11" </CODE></PRE> Tue, 29 Sep 2020 12:48:44 GMT https://community.splunk.com/t5/Splunk-Search/Why-are-data-model-metrics-not-showing-up-with-this-search/m-p/291818#M88138 locose 2020-09-29T12:48:44Z https://community.splunk.com/t5/Splunk-Search/Why-are-data-model-metrics-not-showing-up-with-this-search/m-p/291819#M88139 <P>Try using values() instead of avg(), to check what values are extracting.<BR /> Maybe that field configuration in the datamodel was supposed to be a number but was configured as a string?</P> Wed, 08 Feb 2017 23:07:09 GMT https://community.splunk.com/t5/Splunk-Search/Why-are-data-model-metrics-not-showing-up-with-this-search/m-p/291819#M88139 ehudb 2017-02-08T23:07:09Z https://community.splunk.com/t5/Splunk-Search/Why-are-data-model-metrics-not-showing-up-with-this-search/m-p/291820#M88140 <P>Values() doesn't work and the field is configured as number</P> Thu, 09 Feb 2017 14:08:55 GMT https://community.splunk.com/t5/Splunk-Search/Why-are-data-model-metrics-not-showing-up-with-this-search/m-p/291820#M88140 locose 2017-02-09T14:08:55Z https://community.splunk.com/t5/Splunk-Search/Why-are-data-model-metrics-not-showing-up-with-this-search/m-p/291821#M88141 <P>What do you mean values doesn't work?<BR /> What result you get for:</P> <P>| tstats <CODE>xxxx_summaries_only</CODE> values(All_Performance.Memory.swap_used) AS swap_used FROM datamodel=COY_Performance WHERE nodename="All_Performance.Memory" AND All_Performance.dest="hostname-11"</P> Tue, 29 Sep 2020 12:49:05 GMT https://community.splunk.com/t5/Splunk-Search/Why-are-data-model-metrics-not-showing-up-with-this-search/m-p/291821#M88141 ehudb 2020-09-29T12:49:05Z https://community.splunk.com/t5/Splunk-Search/Why-are-data-model-metrics-not-showing-up-with-this-search/m-p/291822#M88142 <P>correct. <BR /> tstats xxxx_summaries_only values(All_Performance.Memory.swap_used) AS swap_used FROM datamodel=COY_Performance WHERE nodename="All_Performance.Memory" AND All_Performance.dest="hostname-11"</P> <P>didn't work</P> Tue, 29 Sep 2020 12:46:02 GMT https://community.splunk.com/t5/Splunk-Search/Why-are-data-model-metrics-not-showing-up-with-this-search/m-p/291822#M88142 locose 2020-09-29T12:46:02Z https://community.splunk.com/t5/Splunk-Search/Why-are-data-model-metrics-not-showing-up-with-this-search/m-p/291823#M88143 <P>didn't work, but what do you get as a result?</P> Thu, 09 Feb 2017 15:07:18 GMT https://community.splunk.com/t5/Splunk-Search/Why-are-data-model-metrics-not-showing-up-with-this-search/m-p/291823#M88143 ehudb 2017-02-09T15:07:18Z https://community.splunk.com/t5/Splunk-Search/Why-are-data-model-metrics-not-showing-up-with-this-search/m-p/291824#M88144 <P>"no results found"</P> Thu, 09 Feb 2017 15:13:45 GMT https://community.splunk.com/t5/Splunk-Search/Why-are-data-model-metrics-not-showing-up-with-this-search/m-p/291824#M88144 locose 2017-02-09T15:13:45Z https://community.splunk.com/t5/Splunk-Search/Why-are-data-model-metrics-not-showing-up-with-this-search/m-p/291825#M88145 <P>Try to view the table in the pivot, and click "open in search"<BR /> Then inspect the search details and look in search.log<BR /> You will find the |tstats that was running in the background</P> Thu, 09 Feb 2017 15:16:43 GMT https://community.splunk.com/t5/Splunk-Search/Why-are-data-model-metrics-not-showing-up-with-this-search/m-p/291825#M88145 ehudb 2017-02-09T15:16:43Z