Splunk Search

Searching from a data model using tstats, why am I getting "Error in 'TsidxStats': Invalid root event object for datamodel"?

sushmitha_mj
Communicator

I created a data model "Aggregate". I added an object which is a root search object named "usage". There is a search that is written for this object which I can view when I go into the data model. I am having trouble searching from this data model.
The search I wrote:

| tstats max(Usage.field_value) from datamodel="Aggregate"

Where Usage is the root search object and Aggregate is data model name. I get the error

"Error in 'TsidxStats': Invalid root event object for datamodel "

How should I edit my search? Thanks in advance.

0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi sushmitha_mj,

did you create a root event for your data model? Data models are composed chiefly of object hierarchies built on root event objects, see the docs for more details http://docs.splunk.com/Documentation/Splunk/6.2.4/Knowledge/Designdatamodelobjects#Add_a_root_event_...

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi sushmitha_mj,

did you create a root event for your data model? Data models are composed chiefly of object hierarchies built on root event objects, see the docs for more details http://docs.splunk.com/Documentation/Splunk/6.2.4/Knowledge/Designdatamodelobjects#Add_a_root_event_...

cheers, MuS

View solution in original post

sushmitha_mj
Communicator

@MuS
I was able to run the query | tstats values(server.licenser.quota.gb) AS gb from datamodel=internal_server by _time it gave me the Gb info against the time. Thanks

0 Karma

sushmitha_mj
Communicator

Thank @MuS

I added a root object with a constrain and the query now works. But I get no results and no error. How do I query to access my root search output?

0 Karma

MuS
SplunkTrust
SplunkTrust

try this run everywhere search:

| tstats values(server.licenser.quota.gb) AS gb from datamodel=internal_server by _time

This will get you the license quota from the Splunk build in internal data model. Adopt it to your needs

sushmitha_mj
Communicator

@MuS
I am getting the following error
Error in 'TsidxStats': Could not find datamodel: internal_server

0 Karma

MuS
SplunkTrust
SplunkTrust

Make sure, you're in the search app and have admin rights.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!