https://community.splunk.com/t5/Splunk-Search/Datamodel-search-with-Datamodel-Subsearch-Circular-Dependancy/m-p/329025#M97925 <P>This doesn't answer original question and doesn't help any future Splunk users (like me) who have this same problem.</P> Sun, 30 Sep 2018 17:57:43 GMT frechette 2018-09-30T17:57:43Z https://community.splunk.com/t5/Splunk-Search/Datamodel-search-with-Datamodel-Subsearch-Circular-Dependancy/m-p/329018#M97918 <P>How do I fix this search to avoid- 'Error in 'SearchParser': Found circular dependency when expanding datamodel=Intrusion_Detection.Network_IDS_Attacks'</P> <P>|datamodel Intrusion_Detection Network_IDS_Attacks search | search index=alienvault earliest=-0d@d latest=now |eval ReportKey="today" |append [|datamodel Intrusion_Detection Network_IDS_Attacks search |search index=alienvault earliest=-1d@d latest=-0d@d |eval ReportKey="yesterday" |eval _time=_time+86400] |timechart count by ReportKey</P> Tue, 29 Sep 2020 13:03:08 GMT https://community.splunk.com/t5/Splunk-Search/Datamodel-search-with-Datamodel-Subsearch-Circular-Dependancy/m-p/329018#M97918 jgbricker 2020-09-29T13:03:08Z https://community.splunk.com/t5/Splunk-Search/Datamodel-search-with-Datamodel-Subsearch-Circular-Dependancy/m-p/329019#M97919 <P>looks like i just need to convert to using tstats as per the subsearch documentation -</P> <P>'The first command in a subsearch must be a generating command such as search, eventcount, or tstats. For a list of generating commands, see Command types in the Search Reference'</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.5.2/Search/Aboutsubsearches">http://docs.splunk.com/Documentation/Splunk/6.5.2/Search/Aboutsubsearches</A></P> Wed, 01 Mar 2017 19:48:22 GMT https://community.splunk.com/t5/Splunk-Search/Datamodel-search-with-Datamodel-Subsearch-Circular-Dependancy/m-p/329019#M97919 jgbricker 2017-03-01T19:48:22Z https://community.splunk.com/t5/Splunk-Search/Datamodel-search-with-Datamodel-Subsearch-Circular-Dependancy/m-p/329020#M97920 <P>Seems to be kinda difficult to use tstats in this scenario, i think it has to do with aggregating counts before i'm ready to count by timeframe at the end of the search. </P> Wed, 01 Mar 2017 20:34:10 GMT https://community.splunk.com/t5/Splunk-Search/Datamodel-search-with-Datamodel-Subsearch-Circular-Dependancy/m-p/329020#M97920 jgbricker 2017-03-01T20:34:10Z https://community.splunk.com/t5/Splunk-Search/Datamodel-search-with-Datamodel-Subsearch-Circular-Dependancy/m-p/329021#M97921 <P>This seems to work - will need to further validate ..</P> <P>|tstats count FROM datamodel=Intrusion_Detection WHERE index=alienvault earliest=-1d@d latest=-0d@d by _time |eval Report="yesterday" |append [|tstats count FROM datamodel=Intrusion_Detection WHERE index=alienvault earliest=-0d@d latest=now by _time |eval Report="today"] |addinfo |eval _time=if(_time &lt; info_min_time + 24*3600, _time + 24*3600, _time) |xyseries _time Report count</P> Tue, 29 Sep 2020 13:03:18 GMT https://community.splunk.com/t5/Splunk-Search/Datamodel-search-with-Datamodel-Subsearch-Circular-Dependancy/m-p/329021#M97921 jgbricker 2020-09-29T13:03:18Z https://community.splunk.com/t5/Splunk-Search/Datamodel-search-with-Datamodel-Subsearch-Circular-Dependancy/m-p/329022#M97922 <P>The numbers don't match the raw search even with the exact same time aggregation buckets. <span class="lia-unicode-emoji" title=":disappointed_face:">😞</span></P> Wed, 01 Mar 2017 21:10:09 GMT https://community.splunk.com/t5/Splunk-Search/Datamodel-search-with-Datamodel-Subsearch-Circular-Dependancy/m-p/329022#M97922 jgbricker 2017-03-01T21:10:09Z https://community.splunk.com/t5/Splunk-Search/Datamodel-search-with-Datamodel-Subsearch-Circular-Dependancy/m-p/329023#M97923 <P>How about this</P> <PRE><CODE>|tstats count FROM datamodel=Intrusion_Detection WHERE index=alienvault earliest=-1d@d latest=-0d@d by _time span=10m |eval Report="yesterday" | eval _time=_time + 86400 |append [|tstats count FROM datamodel=Intrusion_Detection WHERE index=alienvault earliest=-0d@d latest=now by _time span=10m |eval Report="today"] | timechart sum(count) by Report </CODE></PRE> <P>Equivalent regular search</P> <PRE><CODE>your base search earliest=-1d@d latest=now | eval Report=if(_time&gt;=relative_time(now(),"@d"),"today","yesterday") | eval _time=if(_time&lt;relative_time(now(),"@d"),_time+86400,_time) | timechart count by Report </CODE></PRE> Wed, 01 Mar 2017 22:37:52 GMT https://community.splunk.com/t5/Splunk-Search/Datamodel-search-with-Datamodel-Subsearch-Circular-Dependancy/m-p/329023#M97923 somesoni2 2017-03-01T22:37:52Z https://community.splunk.com/t5/Splunk-Search/Datamodel-search-with-Datamodel-Subsearch-Circular-Dependancy/m-p/329024#M97924 <P>Hi</P> <P>the timewrap ( <A href="http://docs.splunk.com/Documentation/Splunk/7.0.1/SearchReference/Timewrap">http://docs.splunk.com/Documentation/Splunk/7.0.1/SearchReference/Timewrap</A> ) command is now part of Splunk Enterprise, it looks like this is what you are trying to achieve, maybe that command would help and make things easier?</P> <P>Thanks<BR /> Darren</P> Wed, 03 Jan 2018 13:00:57 GMT https://community.splunk.com/t5/Splunk-Search/Datamodel-search-with-Datamodel-Subsearch-Circular-Dependancy/m-p/329024#M97924 ddance_splunk 2018-01-03T13:00:57Z https://community.splunk.com/t5/Splunk-Search/Datamodel-search-with-Datamodel-Subsearch-Circular-Dependancy/m-p/329025#M97925 <P>This doesn't answer original question and doesn't help any future Splunk users (like me) who have this same problem.</P> Sun, 30 Sep 2018 17:57:43 GMT https://community.splunk.com/t5/Splunk-Search/Datamodel-search-with-Datamodel-Subsearch-Circular-Dependancy/m-p/329025#M97925 frechette 2018-09-30T17:57:43Z