Dashboards & Visualizations

i need to inputs values of fields in dashboard using tstats

rahul_mckc_splu
Loves-to-Learn

I have datamodel as AWS and have 2 datasets 1.config and 2. cloud-trail ...
Below is the query which i am using in dashboard to get desired information where i am passing fields but it is not working

|tstats summariesonly=T from datamodel=AWS.config where config.configuration.instanceId=$field1$ OR config.configuration.networkInterfaceId=$field1$ OR config.configuration.groupId=$field1$ OR config.configuration.vpcId==$field1$ by config.aws_account_id | table config.configuration.instanceId config.configuration.networkInterfaceId config.configuration.groupId config.configuration.vpcId

Tags (1)
0 Karma

rahul_mckc_splu
Loves-to-Learn

Yes it is accelerated

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Is the datamodel accelerated and has acceleration completed? If either answer is 'no' then tstats will fail because summariesonly=T is specified.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...