Currently I am trying to optimize my application and I would like to know if it is possible to use TERM() with a datamodel.
I have tried the following:
| tstats count
from datamodel=dm_name
where TERM(host=10.10.10.10)
by host
The search runs but returns no results.
If this is possible, can you show me how to do it?
Is it possible to use TERM() with Datamodel in a tstats?
yes , but host=10.10.10.10
is not in tsidx, I think(there is a minor breaker). so, this text is not searchable.
reference:
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Tstats
Thank you for your answer.
As there are only benefits in using TERM when the filter has minor breakers, can we say that TERM is useless for tstats?
Edited: ... for tstats using a datamodel?
https://docs.splunk.com/Documentation/Splunk/latest/Search/UseCASEandTERMtomatchphrases
index=_internal TERM("series") | stats count
and |tstats count where index=_internal TERM("series")
time picker: all time
check the time that query running.
TERM()
is useful.
Can you show an example with tstats and a datamodel?
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Tstats
Why don't people just read the reference?