Splunk Search

Is it possible to use TERM() with Datamodel in a tstats?

fabio_lourenco
Explorer

Currently I am trying to optimize my application and I would like to know if it is possible to use TERM() with a datamodel.

I have tried the following:

| tstats count   
    from datamodel=dm_name 
    where TERM(host=10.10.10.10)
    by host

The search runs but returns no results.

If this is possible, can you show me how to do it?

0 Karma

to4kawa
Ultra Champion

Is it possible to use TERM() with Datamodel in a tstats?
yes , but host=10.10.10.10 is not in tsidx, I think(there is a minor breaker). so, this text is not searchable.

reference:
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Tstats

0 Karma

fabio_lourenco
Explorer

Thank you for your answer.
As there are only benefits in using TERM when the filter has minor breakers, can we say that TERM is useless for tstats?

Edited: ... for tstats using a datamodel?

0 Karma

to4kawa
Ultra Champion

https://docs.splunk.com/Documentation/Splunk/latest/Search/UseCASEandTERMtomatchphrases

index=_internal TERM("series") | stats count and |tstats count where index=_internal TERM("series")
time picker: all time

check the time that query running.

TERM() is useful.

0 Karma

fabio_lourenco
Explorer

Can you show an example with tstats and a datamodel?

0 Karma

to4kawa
Ultra Champion
0 Karma
Get Updates on the Splunk Community!

Index This | When is October more than just the tenth month?

October 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What’s New & Next in Splunk SOAR

 Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us for an ...