Splunk Search

Error when trying to search Network Traffic data model with tstats

jwalzerpitt
Motivator

I am trying to search the Network Traffic data model, specifically blocked traffic, as follows:

| tstats summariesonly=true allow_old_summaries=true count from datamodel="Network_Traffic"."All_Traffic"."Traffic_By_Action"."Blocked_Traffic"

and I get the following error:

Error in 'DataModelCache': Invalid or unaccelerable root object for datamodel

Am I not chaining the child objects correctly in the search?

Thx

Labels (1)
Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The datamodel keyword takes only the root datamodel name.  To specify a dataset within the DM, use the nodename option.  See https://docs.splunk.com/Documentation/Splunk/8.0.6/SearchReference/Tstats#:~:text=indicating,model

| tstats summariesonly=true allow_old_summaries=true count from datamodel="Network_Traffic" where nodename="All_Traffic"."Traffic_By_Action"."Blocked_Traffic"
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The datamodel keyword takes only the root datamodel name.  To specify a dataset within the DM, use the nodename option.  See https://docs.splunk.com/Documentation/Splunk/8.0.6/SearchReference/Tstats#:~:text=indicating,model

| tstats summariesonly=true allow_old_summaries=true count from datamodel="Network_Traffic" where nodename="All_Traffic"."Traffic_By_Action"."Blocked_Traffic"
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

jwalzerpitt
Motivator

@richgalloway

Thx for the reply and the info.

When I ran the query 

| tstats summariesonly=true allow_old_summaries=true count from datamodel="Network_Traffic" WHERE nodename="All_Traffic"."Traffic_By_Action"."Blocked_Traffic"

I got the following error: Error in 'TsidxStats': WHERE clause is not an exact query

 Thx

Tags (2)
0 Karma

jwalzerpitt
Motivator

Figured out the issue after banging away for a little - I had to drop the quotes from the nodenames

 

| tstats summariesonly=true allow_old_summaries=true count from datamodel="Network_Traffic" WHERE nodename=All_Traffic.Traffic_By_Action.Blocked_Traffic BY _time span=1h