Knowledge Management

Is there a tsistats or something similar for summarizing accelerated data model data?

jamesvz84
Communicator

We would like to benefit from the performance benefit of an accelerated data model, however, we also need to summarize data from the accelerated data model into a summary index.

I would like to use sistats with an accelerated data model. Is this possible? There doesn't seem to be any commands that will allow for this.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You'll find tstats is just that, specify the data model with the FROM keyword and go.

http://docs.splunk.com/Documentation/Splunk/6.2.4/SearchReference/tstats

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...

Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass

Hello Splunkers,  We’re excited to kick off a Splunk Dashboard contest! We know that dashboards are a primary ...