Splunk Search

How To Use tstats with nested data models - getting empty results

Explorer

I have a DataModel named "AccessLogs" and it has a DataSet hierarchy that looks like this
RootSearchDS // sourcetype=http_access_log
BusinessHoursDS // Child of RootSearchDS, Some filtering to only include Mon-Fri work hours
BetaDS // Child of BusinessHoursDS, host=BetaServer*
ProdDS // Child of BusinessHoursDS, host=ProdServer*

I've enabled the DataModel to be publicly available and I've enabled acceleration for 1 day.

Now, I'm trying to use the tstats function to return some results about my DataSets. I'm running queries over around 1-2 Terrabytes of data collected over 3 months. The normal pivots are very slow - a few hours to run - so I was hoping the tstats function would provide a faster alternative. I just need basic stats on my DataSets - like avg values segmented by week of the year.

Here's my tstats command:

| tstats count avg(ResponseTimeMillis) as "AvgResponse" FROM datamodel=AccessLogs.RootSearchDS WHERE nodename=RootSearchDS.BusinessHoursDS.BetaDS by TimeWeekOfYear

I can see the count field is populated with data but the AvgResponse field is always blank. It looks like this field doesn't exist. But when I pivot off my data model AccessLogs > RootSearch > BusHours > Beta I can see that the ResponseTimeMillis field does exist.

Anyone know why the avg(ResponseTimeMillis) might be blank? Did I specify my "datamodel" and "nodename" parameters correctly? Does ResponseTimeMillis need to be set as a "required" field in my DataSet?

1 Solution

SplunkTrust
SplunkTrust

You need to prefix the field name with the data model name: avg(AccessLogs.ResponseTimeMillis)

View solution in original post

Explorer

Thanks martin! Your answer led me to the correct one - almost right.

I need to append with my root search (not the data model name)

avg(RootSearchDS.ResponseTimeMillis)
0 Karma

SplunkTrust
SplunkTrust

You need to prefix the field name with the data model name: avg(AccessLogs.ResponseTimeMillis)

View solution in original post

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!