Splunk Search

Is it possible to use TERM() with Datamodel in a tstats?

fabio_lourenco
Explorer

Currently I am trying to optimize my application and I would like to know if it is possible to use TERM() with a datamodel.

I have tried the following:

| tstats count   
    from datamodel=dm_name 
    where TERM(host=10.10.10.10)
    by host

The search runs but returns no results.

If this is possible, can you show me how to do it?

0 Karma

to4kawa
Ultra Champion

Is it possible to use TERM() with Datamodel in a tstats?
yes , but host=10.10.10.10 is not in tsidx, I think(there is a minor breaker). so, this text is not searchable.

reference:
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Tstats

0 Karma

fabio_lourenco
Explorer

Thank you for your answer.
As there are only benefits in using TERM when the filter has minor breakers, can we say that TERM is useless for tstats?

Edited: ... for tstats using a datamodel?

0 Karma

to4kawa
Ultra Champion

https://docs.splunk.com/Documentation/Splunk/latest/Search/UseCASEandTERMtomatchphrases

index=_internal TERM("series") | stats count and |tstats count where index=_internal TERM("series")
time picker: all time

check the time that query running.

TERM() is useful.

0 Karma

fabio_lourenco
Explorer

Can you show an example with tstats and a datamodel?

0 Karma

to4kawa
Ultra Champion
0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...