Splunk Search
×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question

How can I speed up a search by creating a data model using tstats?

pil321
Communicator
‎02-12-2018 07:53 AM

I want to speed up a search by creating a data model and using tstats.

This is the search using the data model so far:

| tstats count from datamodel=WinEvents.Summary by _time, host, Summary.EventCode, Summary.SourceName, Summary.Type, Summary.Keywords span=1m | stats earliest(_time) as First latest(_time) as Last count by host, Summary.EventCode, Summary.SourceName,  Summary.Type

On the original search, I used eval:

...| eval Type=if(Keywords=="Audit Success", Keywords, Type) | eval Type=if(Keywords=="Audit Failure", Keywords, Type)

Since that is a complex aggregate function (according to the documentation), how do I make that work with tstats?

0 Karma
Reply
Get Updates on the Splunk Community!

Introducing a Smarter Way to Discover Apps on Splunkbase

We’re excited to announce the launch of a foundational enhancement to Splunkbase: App Tiering. Because we’ve ...

How to Send Splunk Observability Alerts to Webex teams in Minutes

As a Developer Evangelist at Splunk, my team and I are constantly tinkering with technology to explore its ...

.conf25 Registration is OPEN!

Ready. Set. Splunk! Your favorite Splunk user event is back and better than ever. Get ready for more technical ...