Splunk Search

Is it possible to use TERM() with Datamodel in a tstats?

fabio_lourenco
Explorer

Currently I am trying to optimize my application and I would like to know if it is possible to use TERM() with a datamodel.

I have tried the following:

| tstats count   
    from datamodel=dm_name 
    where TERM(host=10.10.10.10)
    by host

The search runs but returns no results.

If this is possible, can you show me how to do it?

0 Karma

to4kawa
Ultra Champion

Is it possible to use TERM() with Datamodel in a tstats?
yes , but host=10.10.10.10 is not in tsidx, I think(there is a minor breaker). so, this text is not searchable.

reference:
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Tstats

0 Karma

fabio_lourenco
Explorer

Thank you for your answer.
As there are only benefits in using TERM when the filter has minor breakers, can we say that TERM is useless for tstats?

Edited: ... for tstats using a datamodel?

0 Karma

to4kawa
Ultra Champion

https://docs.splunk.com/Documentation/Splunk/latest/Search/UseCASEandTERMtomatchphrases

index=_internal TERM("series") | stats count and |tstats count where index=_internal TERM("series")
time picker: all time

check the time that query running.

TERM() is useful.

0 Karma

fabio_lourenco
Explorer

Can you show an example with tstats and a datamodel?

0 Karma

to4kawa
Ultra Champion
0 Karma
Get Updates on the Splunk Community!

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...