Error in tstats command despite being first command in search

[ebs]

I'm trying to validate this search, but I'm getting this error: Error in 'tstats' command: This command must be the first command of a search.

I don't know why I'm getting this error as it is the first in the search:

| tstats count as api_calls from datamodel=Change where All_Changes.user!=unknown All_Changes.status=success by All_Changes.user _time span=1h 
| `drop_dm_object_name("All_Changes")` 
| eval HourOfDay=strftime(_time, "%H") 
| eval HourOfDay=floor(HourOfDay/4)*4 
| eval DayOfWeek=strftime(_time, "%w") 
| eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) 
| table _time api_calls, user, HourOfDay, isWeekend 
| eventstats dc(api_calls) as api_calls by user, HourOfDay, isWeekend 
| where api_calls >= 1 
| fit DensityFunction api_calls by "user,HourOfDay,isWeekend" into cloud_excessive_api_calls_v1 dist=norm show_density=true 
| tstats count as api_calls from datamodel=Change where All_Changes.user!=unknown All_Changes.status=success by All_Changes.user _time span=1h 
| `drop_dm_object_name("All_Changes")` 
| eval HourOfDay=strftime(_time, "%H") 
| eval HourOfDay=floor(HourOfDay/4)*4 
| eval DayOfWeek=strftime(_time, "%w") 
| eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) 
| table _time api_calls, user, HourOfDay, isWeekend 
| eventstats dc(api_calls) as api_calls by user, HourOfDay, isWeekend 
| where api_calls >= 1 
| fit DensityFunction api_calls by "user,HourOfDay,isWeekend" into cloud_excessive_api_calls_v1 dist=norm show_density=true

Is this a bug or what? The search is produced by ESCU, I'm just making sure it works with the data we have

[bowesmana]

You have the same search what appears to be twice - i.e. the search is a 10 line search repeated twice, with a second tstats on the 11th line after the fit statement. Is that a typo?

[renjith_nair]

Just suggestion : Please use code sample (<>) to add your search or XML snippets for better readability. Edited and formatted this post 🙂

Not sure if it's a copy paste error, but the search is repeating and hence you have a second tstats in the middle of the search.