Dashboards & Visualizations

i need to inputs values of fields in dashboard using tstats

rahul_mckc_splu
Loves-to-Learn

I have datamodel as AWS and have 2 datasets 1.config and 2. cloud-trail ...
Below is the query which i am using in dashboard to get desired information where i am passing fields but it is not working

|tstats summariesonly=T from datamodel=AWS.config where config.configuration.instanceId=$field1$ OR config.configuration.networkInterfaceId=$field1$ OR config.configuration.groupId=$field1$ OR config.configuration.vpcId==$field1$ by config.aws_account_id | table config.configuration.instanceId config.configuration.networkInterfaceId config.configuration.groupId config.configuration.vpcId

Tags (1)
0 Karma

rahul_mckc_splu
Loves-to-Learn

Yes it is accelerated

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Is the datamodel accelerated and has acceleration completed? If either answer is 'no' then tstats will fail because summariesonly=T is specified.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...