Is it possible to perform a tstats from an accelerated savedsearch?

[ericg57]

I am asking because I attempted to use "savedsearch=" as a command after a | tstats much like calling a "datamodel=" , and I now see that the "savedsearch=" is highlighhted as if it should be as if it is an accepted command.

|tstats savedsearch=mysavedsearch

[vinod94]

Hi @ericg57 ,

You can run a Report Name through savedsearch command. You can make it work like this.

| savedsearch "Report Name"

You can also use tstats in a "Report Name" (ie in the search query of Report) and then call it from savedsearch.

For better understanding of savedsearch=

you can check this doc ... hope this clears your concern

https://docs.splunk.com/Documentation/Splunk/7.2.4/SearchReference/Loadjob

[ericg57]

Correction: and I now see that the "savedsearch=" is highlighhted as if it should be an accepted command.