Splunk Dev

How to leverage the data from tstats query from a datamodel to stats command?

kaur_aman18
New Member

I am using C#SDK to search for | tstats count FROM datamodel=IIS_Data WHERE nodename=IIS_events IIS_events.cs_method='GET'.... but it is failing with "Error in 'tstats' command: This command is not supported in a real-time search".

If we replace tstats with stats and what else we need to make change?

0 Karma

FrankVl
Ultra Champion

Not familiar with the C# SDK and not sure what exactly you want to achieve, but can you not just run it as a normal search instead of a realtime search? Doing realtime searches on an accelerated data model anyway doesn't make much sense.
See https://dev.splunk.com/view/csharp-sdk-pcl/SP-CAAAEYY for the differences and how to run them.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...