Error when trying to search Network Traffic data model with tstats

[jwalzerpitt]

I am trying to search the Network Traffic data model, specifically blocked traffic, as follows:

| tstats summariesonly=true allow_old_summaries=true count from datamodel="Network_Traffic"."All_Traffic"."Traffic_By_Action"."Blocked_Traffic"

and I get the following error:

Error in 'DataModelCache': Invalid or unaccelerable root object for datamodel

Am I not chaining the child objects correctly in the search?

Thx

[richgalloway · Accepted solution]

The datamodel keyword takes only the root datamodel name.  To specify a dataset within the DM, use the nodename option.  See https://docs.splunk.com/Documentation/Splunk/8.0.6/SearchReference/Tstats#:~:text=indicating,model

| tstats summariesonly=true allow_old_summaries=true count from datamodel="Network_Traffic" where nodename="All_Traffic"."Traffic_By_Action"."Blocked_Traffic"

[jwalzerpitt]

@richgalloway

Thx for the reply and the info.

When I ran the query 

| tstats summariesonly=true allow_old_summaries=true count from datamodel="Network_Traffic" WHERE nodename="All_Traffic"."Traffic_By_Action"."Blocked_Traffic"

I got the following error: Error in 'TsidxStats': WHERE clause is not an exact query

 Thx

[jwalzerpitt]

Figured out the issue after banging away for a little - I had to drop the quotes from the nodenames

| tstats summariesonly=true allow_old_summaries=true count from datamodel="Network_Traffic" WHERE nodename=All_Traffic.Traffic_By_Action.Blocked_Traffic BY _time span=1h