Dashboards & Visualizations

i need to inputs values of fields in dashboard using tstats

rahul_mckc_splu
Loves-to-Learn

I have datamodel as AWS and have 2 datasets 1.config and 2. cloud-trail ...
Below is the query which i am using in dashboard to get desired information where i am passing fields but it is not working

|tstats summariesonly=T from datamodel=AWS.config where config.configuration.instanceId=$field1$ OR config.configuration.networkInterfaceId=$field1$ OR config.configuration.groupId=$field1$ OR config.configuration.vpcId==$field1$ by config.aws_account_id | table config.configuration.instanceId config.configuration.networkInterfaceId config.configuration.groupId config.configuration.vpcId

Tags (1)
0 Karma

rahul_mckc_splu
Loves-to-Learn

Yes it is accelerated

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Is the datamodel accelerated and has acceleration completed? If either answer is 'no' then tstats will fail because summariesonly=T is specified.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...