Splunk Search

Is it possible to use TERM() with Datamodel in a tstats?

fabio_lourenco
Explorer

Currently I am trying to optimize my application and I would like to know if it is possible to use TERM() with a datamodel.

I have tried the following:

| tstats count   
    from datamodel=dm_name 
    where TERM(host=10.10.10.10)
    by host

The search runs but returns no results.

If this is possible, can you show me how to do it?

0 Karma

to4kawa
Ultra Champion

Is it possible to use TERM() with Datamodel in a tstats?
yes , but host=10.10.10.10 is not in tsidx, I think(there is a minor breaker). so, this text is not searchable.

reference:
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Tstats

0 Karma

fabio_lourenco
Explorer

Thank you for your answer.
As there are only benefits in using TERM when the filter has minor breakers, can we say that TERM is useless for tstats?

Edited: ... for tstats using a datamodel?

0 Karma

to4kawa
Ultra Champion

https://docs.splunk.com/Documentation/Splunk/latest/Search/UseCASEandTERMtomatchphrases

index=_internal TERM("series") | stats count and |tstats count where index=_internal TERM("series")
time picker: all time

check the time that query running.

TERM() is useful.

0 Karma

fabio_lourenco
Explorer

Can you show an example with tstats and a datamodel?

0 Karma

to4kawa
Ultra Champion
0 Karma
Get Updates on the Splunk Community!

Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud

 Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team for an ...

Update Your SOAR Apps for Python 3.13: What Community Developers Need to Know

To Community SOAR App Developers - we're reaching out with an important update regarding Python 3.9's ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...