https://community.splunk.com/t5/Splunk-Search/How-To-Use-tstats-with-nested-data-models-getting-empty-results/m-p/336964#M99981 <P>You need to prefix the field name with the data model name: <CODE>avg(AccessLogs.ResponseTimeMillis)</CODE></P> Tue, 18 Apr 2017 00:20:47 GMT martin_mueller 2017-04-18T00:20:47Z https://community.splunk.com/t5/Splunk-Search/How-To-Use-tstats-with-nested-data-models-getting-empty-results/m-p/336963#M99980 <P>I have a DataModel named "AccessLogs" and it has a DataSet hierarchy that looks like this<BR /> RootSearchDS // sourcetype=http_access_log<BR /> BusinessHoursDS // Child of RootSearchDS, Some filtering to only include Mon-Fri work hours<BR /> BetaDS // Child of BusinessHoursDS, host=BetaServer*<BR /> ProdDS // Child of BusinessHoursDS, host=ProdServer*</P> <P>I've enabled the DataModel to be publicly available and I've enabled acceleration for 1 day.</P> <P>Now, I'm trying to use the tstats function to return some results about my DataSets. I'm running queries over around 1-2 Terrabytes of data collected over 3 months. The normal pivots are very slow - a few hours to run - so I was hoping the tstats function would provide a faster alternative. I just need basic stats on my DataSets - like avg values segmented by week of the year.</P> <P>Here's my tstats command:</P> <P>| tstats count avg(ResponseTimeMillis) as "AvgResponse" FROM datamodel=AccessLogs.RootSearchDS WHERE nodename=RootSearchDS.BusinessHoursDS.BetaDS by TimeWeekOfYear </P> <P>I can see the count field is populated with data but the AvgResponse field is always blank. It looks like this field doesn't exist. But when I pivot off my data model AccessLogs &gt; RootSearch &gt; BusHours &gt; Beta I can see that the ResponseTimeMillis field does exist.</P> <P>Anyone know why the avg(ResponseTimeMillis) might be blank? Did I specify my "datamodel" and "nodename" parameters correctly? Does ResponseTimeMillis need to be set as a "required" field in my DataSet?</P> Tue, 29 Sep 2020 13:44:12 GMT https://community.splunk.com/t5/Splunk-Search/How-To-Use-tstats-with-nested-data-models-getting-empty-results/m-p/336963#M99980 theironcook 2020-09-29T13:44:12Z https://community.splunk.com/t5/Splunk-Search/How-To-Use-tstats-with-nested-data-models-getting-empty-results/m-p/336964#M99981 <P>You need to prefix the field name with the data model name: <CODE>avg(AccessLogs.ResponseTimeMillis)</CODE></P> Tue, 18 Apr 2017 00:20:47 GMT https://community.splunk.com/t5/Splunk-Search/How-To-Use-tstats-with-nested-data-models-getting-empty-results/m-p/336964#M99981 martin_mueller 2017-04-18T00:20:47Z https://community.splunk.com/t5/Splunk-Search/How-To-Use-tstats-with-nested-data-models-getting-empty-results/m-p/336965#M99982 <P>Thanks martin! Your answer led me to the correct one - almost right.</P> <P>I need to append with my root search (not the data model name)</P> <PRE><CODE>avg(RootSearchDS.ResponseTimeMillis) </CODE></PRE> Tue, 18 Apr 2017 14:53:29 GMT https://community.splunk.com/t5/Splunk-Search/How-To-Use-tstats-with-nested-data-models-getting-empty-results/m-p/336965#M99982 theironcook 2017-04-18T14:53:29Z