i am attempting to use tstats to make this search faster
index="wss_events" sourcetype=symantec:websecurityservice:scwss-poll[| inputlookup "WSSIOC4.csv"| rename match as query| fields query ]
i get an an error that i dont understand . Can anyone tell me what i need to correct to use tstats , or am i trying to do something impossible ?
you can not use tstats for indexed data. your indexes should be part of datamodel and datamodel should have been accelerated. read about tstats command below:
The tstats command can be used with indexed fields.
i have made the index a data model , but still getting errors that i cant work out
When using subsearches, it's a good idea to run the subsearch by itself with | format appended as in
| inputlookup mylookup.csv | rename foo as bar | fields bar | format
The result will show exactly what is added to the main search. If the resulting text is not valid as part of a search then the subsearch must be modified.