Splunk Enterprise

Can someone explain the prestats option within tstats?

lennys26
Communicator

Can someone explain the prestats option within tstats?

I have reread the docs a bunch of times but just don't find a clear explanation of what it does other than it is "designed to be consumed by commands that generate aggregate calculations".

Below I have 2 very basic queries which are returning vastly different results.

 

index="myindex" sourcetype="mysource" DRA=B*
| rex field=DRA "^(?<pfx>\D\S{1}).*" 
| timechart count by pfx useother=f limit=0 usenull=f

 

AND

 

| tstats prestats=t count where index="myindex" sourcetype="mysourcetype" DRA=B* by DRA, _time 
| rex field=DRA "^(?<pfx>\D\S{1}).*" 
| timechart count by pfx useother=f limit=0 usenull=f

 

 

I get it -- I must use prestats for the search using tstats but, then, what are the values that it IS returning without prestats? What is prestats doing? 

 

Labels (1)
Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

If two different searches produce the same results, then those results are likely to be correct.

I'm not very familiar with the inner workings of prestats, but understand it includes a few internal fields that timechart uses to produces its results.  With prestats=f, the timechart command is aggregating an aggregration, which isn't accurate - the same way you can't average averages.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

How different are the two results?  Which one is correct?

---
If this reply helps you, Karma would be appreciated.
0 Karma

lennys26
Communicator

@richgalloway - I just double checked my initial post and it looks like I pasted the wrong query, sorry.

The index search and the tstats search show the same results., while the tstats prestats=t search shows something different.

So the following two searches return the same results:

index="myindex" sourcetype="mysource" DRA=B*
| rex field=DRA "^(?<pfx>\D\S{1}).*" 
| timechart count by pfx useother=f limit=0 usenull=f
| tstats prestats=t count where index="myindex" sourcetype="mysourcetype" DRA=B* by DRA, _time 
| rex field=DRA "^(?<pfx>\D\S{1}).*" 
| timechart count by pfx useother=f limit=0 usenull=f

 

The following search (prestats=f) returns something vastly different:

| tstats count where index="myindex" sourcetype="mysourcetype" DRA=B* by DRA, _time 
| rex field=DRA "^(?<pfx>\D\S{1}).*" 
| timechart count by pfx useother=f limit=0 usenull=f

 

I suspect that the index and prestats=t results are correct, however I need to confirm.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If two different searches produce the same results, then those results are likely to be correct.

I'm not very familiar with the inner workings of prestats, but understand it includes a few internal fields that timechart uses to produces its results.  With prestats=f, the timechart command is aggregating an aggregration, which isn't accurate - the same way you can't average averages.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...