Data Model Query tstats

[sumitkathpal]

Dear Experts,

Request you help to convert this below query into tstats query.

index=network_proxy category="Personal Network Storage and Backup" | eval Megabytes=(((bytes_out/1024)/1024))| stats sum(Megabytes) as Megabytes by user dest_nt_host |eval Megabytes=round(Megabytes,3)| sort -Megabytes| fields user dest_nt_host Megabytes|head 10

Converting into tstats

(| tstats count from datamodel=Web where (nodename = Web.Proxy) (Web.category="Personal Network Storage and Backup" ) (Web.user!="LDAP*") by Web.user ) help required to how to do this.

Thanks in advance.

[rjthibod · Accepted solution]

I don't have this Datamodel to test with, but the query you are looking for should be close to this.

| tstats sum(Web.bytes_out) as bytes from datamodel=Web where (nodename = Web.Proxy) (Web.category="Personal Network Storage and Backup") (Web.user!="LDAP*") by Web.user Web.dest_nt_host
| rename Web.user as user, Web.dest_nt_host as dest_nt_host
| sort 10 -bytes
| eval Megabytes= round((bytes/1024/1024), 3)
| fields user dest_nt_host Megabytes