I'm new to Datamodel then perhaps my 2 questions are basics I checked google and docs but wasn't able to find an answer.
Impossible to see child's fields when using summariesonly (no problem for root's fields)
With tstats I have results when counting "tag" for my root's "S" or child's "S.goog"
| tstats count from datamodel=proxy where earliest=-10m nodename=S by S.tag S.tag count Compliance 22213 Denied 5693 error 229 google 8084 | tstats count from datamodel=proxy where earliest=-10m nodename=S.goog by S.tag S.tag count Compliance 1263 error 10 google 8120
With tstats summariesonly=t i have only results for root:
| tstats summariesonly=t count from datamodel=proxy where earliest=-10m nodename=S by S.tag S.tag count Compliance 7702 Denied 1833 error 73 | tstats summariesonly=t count from datamodel=proxy where earliest=-10m nodename=S.goog by S.tag No result found
I thought summariesonly was to tell splunk to check only accelerated's .tsidx (not to check data not accelerated)
In doc's splunk:
"To accelerate a data model, it must contain at least one root event dataset, or one root search dataset that only uses streaming commands. Acceleration only affects these dataset types and datasets that are children of those root datasets."
Then why can't I see child's fields like S.tag or nodename=S.goog in .tsidx?
Do I have to activate something on child?
I have a result when I search "last days", "last hour", earliest=-10m but nothing happens if I choose a timerange: Is it a bug in Splunk v6.5 ?