Splunk Enterprise

How to use tstats to make a search faster (getting errors)?

splunkyboy2
Explorer

i am attempting  to use tstats to make this search faster 

index="wss_events" sourcetype=symantec:websecurityservice:scwss-poll
[| inputlookup "WSSIOC4.csv"
| rename match as query
| fields query ]

i get an an error that i dont understand . Can anyone tell me what i need to correct to use tstats , or am i trying to do something impossible ?

splunkyboy2_0-1600947537389.png

 

Labels (1)
0 Karma

thambisetty
Super Champion

you can not use tstats for indexed data. your indexes should be part of datamodel and datamodel should have been accelerated. read about tstats command below:

https://docs.splunk.com/Documentation/Splunk/8.0.6/SearchReference/Tstats 

————————————
If this helps, give a like below.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The tstats command can be used with indexed fields.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

splunkyboy2
Explorer

splunkyboy2_0-1600958164103.png

i have made the index a data model , but still getting errors that i cant work out 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

When using subsearches, it's a good idea to run the subsearch by itself with | format appended as in 

| inputlookup mylookup.csv | rename foo as bar | fields bar | format

The result will show exactly what is added to the main search.  If the resulting text is not valid as part of a search then the subsearch must be modified.

 

---
If this reply helps you, an upvote would be appreciated.
0 Karma