I have datamodel as AWS and have 2 datasets 1.config and 2. cloud-trail ...
Below is the query which i am using in dashboard to get desired information where i am passing fields but it is not working
|tstats summariesonly=T from datamodel=AWS.config where config.configuration.instanceId=$field1$ OR config.configuration.networkInterfaceId=$field1$ OR config.configuration.groupId=$field1$ OR config.configuration.vpcId==$field1$ by config.aws_account_id | table config.configuration.instanceId config.configuration.networkInterfaceId config.configuration.groupId config.configuration.vpcId
Yes it is accelerated
Is the datamodel accelerated and has acceleration completed? If either answer is 'no' then tstats
will fail because summariesonly=T
is specified.