How To Use tstats with nested data models - getting empty results

[theironcook]

I have a DataModel named "AccessLogs" and it has a DataSet hierarchy that looks like this
RootSearchDS // sourcetype=http_access_log
BusinessHoursDS // Child of RootSearchDS, Some filtering to only include Mon-Fri work hours
BetaDS // Child of BusinessHoursDS, host=BetaServer*
ProdDS // Child of BusinessHoursDS, host=ProdServer*

I've enabled the DataModel to be publicly available and I've enabled acceleration for 1 day.

Now, I'm trying to use the tstats function to return some results about my DataSets. I'm running queries over around 1-2 Terrabytes of data collected over 3 months. The normal pivots are very slow - a few hours to run - so I was hoping the tstats function would provide a faster alternative. I just need basic stats on my DataSets - like avg values segmented by week of the year.

Here's my tstats command:

| tstats count avg(ResponseTimeMillis) as "AvgResponse" FROM datamodel=AccessLogs.RootSearchDS WHERE nodename=RootSearchDS.BusinessHoursDS.BetaDS by TimeWeekOfYear

I can see the count field is populated with data but the AvgResponse field is always blank. It looks like this field doesn't exist. But when I pivot off my data model AccessLogs > RootSearch > BusHours > Beta I can see that the ResponseTimeMillis field does exist.

Anyone know why the avg(ResponseTimeMillis) might be blank? Did I specify my "datamodel" and "nodename" parameters correctly? Does ResponseTimeMillis need to be set as a "required" field in my DataSet?

[theironcook]

Thanks martin! Your answer led me to the correct one - almost right.

I need to append with my root search (not the data model name)

avg(RootSearchDS.ResponseTimeMillis)

[martin_mueller · Accepted solution]

You need to prefix the field name with the data model name: avg(AccessLogs.ResponseTimeMillis)