Splunk Enterprise

Can someone explain the prestats option within tstats?

lennys26
Communicator

Can someone explain the prestats option within tstats?

I have reread the docs a bunch of times but just don't find a clear explanation of what it does other than it is "designed to be consumed by commands that generate aggregate calculations".

Below I have 2 very basic queries which are returning vastly different results.

 

index="myindex" sourcetype="mysource" DRA=B*
| rex field=DRA "^(?<pfx>\D\S{1}).*" 
| timechart count by pfx useother=f limit=0 usenull=f

 

AND

 

| tstats prestats=t count where index="myindex" sourcetype="mysourcetype" DRA=B* by DRA, _time 
| rex field=DRA "^(?<pfx>\D\S{1}).*" 
| timechart count by pfx useother=f limit=0 usenull=f

 

 

I get it -- I must use prestats for the search using tstats but, then, what are the values that it IS returning without prestats? What is prestats doing? 

 

Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

If two different searches produce the same results, then those results are likely to be correct.

I'm not very familiar with the inner workings of prestats, but understand it includes a few internal fields that timechart uses to produces its results.  With prestats=f, the timechart command is aggregating an aggregration, which isn't accurate - the same way you can't average averages.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

How different are the two results?  Which one is correct?

---
If this reply helps you, Karma would be appreciated.
0 Karma

lennys26
Communicator

@richgalloway - I just double checked my initial post and it looks like I pasted the wrong query, sorry.

The index search and the tstats search show the same results., while the tstats prestats=t search shows something different.

So the following two searches return the same results:

index="myindex" sourcetype="mysource" DRA=B*
| rex field=DRA "^(?<pfx>\D\S{1}).*" 
| timechart count by pfx useother=f limit=0 usenull=f
| tstats prestats=t count where index="myindex" sourcetype="mysourcetype" DRA=B* by DRA, _time 
| rex field=DRA "^(?<pfx>\D\S{1}).*" 
| timechart count by pfx useother=f limit=0 usenull=f

 

The following search (prestats=f) returns something vastly different:

| tstats count where index="myindex" sourcetype="mysourcetype" DRA=B* by DRA, _time 
| rex field=DRA "^(?<pfx>\D\S{1}).*" 
| timechart count by pfx useother=f limit=0 usenull=f

 

I suspect that the index and prestats=t results are correct, however I need to confirm.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If two different searches produce the same results, then those results are likely to be correct.

I'm not very familiar with the inner workings of prestats, but understand it includes a few internal fields that timechart uses to produces its results.  With prestats=f, the timechart command is aggregating an aggregration, which isn't accurate - the same way you can't average averages.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...