Splunk Search

Is it possible to use results_preview with a tstats search on a data model?


I am running a Splunk query that looks like this below, and runs on an accelerated data model (this is not an exact query, but just illustrates the logic)

| tstats `list_of_my_tstats_fields` from datamodel=my_datamodel 
    where my_condition_is_satisfied
    by _time g.id 
| `my_datamodel_tstats_clean` 

After sending this query to Splunk with a HTTP request and after getting the Job ID, I am trying to use the results_preview HTTP endpoint in order to get a preview of the results of this query. However, I get no result items in the results_preview query until the search exits the "Running" state. If the where my_condition_is_satisfied clause is broad enough, I even get this screen for minutes:
alt text

Is it possible to use results_preview to return previewed results with the query above?

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...