Splunk Search

Is it possible to use TERM() with Datamodel in a tstats?

fabio_lourenco
Explorer

Currently I am trying to optimize my application and I would like to know if it is possible to use TERM() with a datamodel.

I have tried the following:

| tstats count   
    from datamodel=dm_name 
    where TERM(host=10.10.10.10)
    by host

The search runs but returns no results.

If this is possible, can you show me how to do it?

0 Karma

to4kawa
SplunkTrust
SplunkTrust

Is it possible to use TERM() with Datamodel in a tstats?
yes , but host=10.10.10.10 is not in tsidx, I think(there is a minor breaker). so, this text is not searchable.

reference:
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Tstats

0 Karma

fabio_lourenco
Explorer

Thank you for your answer.
As there are only benefits in using TERM when the filter has minor breakers, can we say that TERM is useless for tstats?

Edited: ... for tstats using a datamodel?

0 Karma

to4kawa
SplunkTrust
SplunkTrust

https://docs.splunk.com/Documentation/Splunk/latest/Search/UseCASEandTERMtomatchphrases

index=_internal TERM("series") | stats count and |tstats count where index=_internal TERM("series")
time picker: all time

check the time that query running.

TERM() is useful.

0 Karma

fabio_lourenco
Explorer

Can you show an example with tstats and a datamodel?

0 Karma

to4kawa
SplunkTrust
SplunkTrust
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!