Splunk Search

How To Use tstats with nested data models - getting empty results

theironcook
Explorer

I have a DataModel named "AccessLogs" and it has a DataSet hierarchy that looks like this
RootSearchDS // sourcetype=http_access_log
BusinessHoursDS // Child of RootSearchDS, Some filtering to only include Mon-Fri work hours
BetaDS // Child of BusinessHoursDS, host=BetaServer*
ProdDS // Child of BusinessHoursDS, host=ProdServer*

I've enabled the DataModel to be publicly available and I've enabled acceleration for 1 day.

Now, I'm trying to use the tstats function to return some results about my DataSets. I'm running queries over around 1-2 Terrabytes of data collected over 3 months. The normal pivots are very slow - a few hours to run - so I was hoping the tstats function would provide a faster alternative. I just need basic stats on my DataSets - like avg values segmented by week of the year.

Here's my tstats command:

| tstats count avg(ResponseTimeMillis) as "AvgResponse" FROM datamodel=AccessLogs.RootSearchDS WHERE nodename=RootSearchDS.BusinessHoursDS.BetaDS by TimeWeekOfYear

I can see the count field is populated with data but the AvgResponse field is always blank. It looks like this field doesn't exist. But when I pivot off my data model AccessLogs > RootSearch > BusHours > Beta I can see that the ResponseTimeMillis field does exist.

Anyone know why the avg(ResponseTimeMillis) might be blank? Did I specify my "datamodel" and "nodename" parameters correctly? Does ResponseTimeMillis need to be set as a "required" field in my DataSet?

1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You need to prefix the field name with the data model name: avg(AccessLogs.ResponseTimeMillis)

View solution in original post

theironcook
Explorer

Thanks martin! Your answer led me to the correct one - almost right.

I need to append with my root search (not the data model name)

avg(RootSearchDS.ResponseTimeMillis)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You need to prefix the field name with the data model name: avg(AccessLogs.ResponseTimeMillis)

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...