Splunk Search

Is it possible to use results_preview with a tstats search on a data model?


I am running a Splunk query that looks like this below, and runs on an accelerated data model (this is not an exact query, but just illustrates the logic)

| tstats `list_of_my_tstats_fields` from datamodel=my_datamodel 
    where my_condition_is_satisfied
    by _time g.id 
| `my_datamodel_tstats_clean` 

After sending this query to Splunk with a HTTP request and after getting the Job ID, I am trying to use the results_preview HTTP endpoint in order to get a preview of the results of this query. However, I get no result items in the results_preview query until the search exits the "Running" state. If the where my_condition_is_satisfied clause is broad enough, I even get this screen for minutes:
alt text

Is it possible to use results_preview to return previewed results with the query above?

0 Karma