I created a data model "Aggregate". I added an object which is a root search object named "usage". There is a search that is written for this object which I can view when I go into the data model. I am having trouble searching from this data model.
The search I wrote:
| tstats max(Usage.field_value) from datamodel="Aggregate"
Where Usage is the root search object and Aggregate is data model name. I get the error
"Error in 'TsidxStats': Invalid root event object for datamodel "
How should I edit my search? Thanks in advance.
Hi sushmitha_mj,
did you create a root event for your data model? Data models are composed chiefly of object hierarchies built on root event objects, see the docs for more details http://docs.splunk.com/Documentation/Splunk/6.2.4/Knowledge/Designdatamodelobjects#Add_a_root_event_...
cheers, MuS
Hi sushmitha_mj,
did you create a root event for your data model? Data models are composed chiefly of object hierarchies built on root event objects, see the docs for more details http://docs.splunk.com/Documentation/Splunk/6.2.4/Knowledge/Designdatamodelobjects#Add_a_root_event_...
cheers, MuS
@MuS
I was able to run the query | tstats values(server.licenser.quota.gb) AS gb from datamodel=internal_server by _time it gave me the Gb info against the time. Thanks
Thank @MuS
I added a root object with a constrain and the query now works. But I get no results and no error. How do I query to access my root search output?
try this run everywhere search:
| tstats values(server.licenser.quota.gb) AS gb from datamodel=internal_server by _time
This will get you the license quota from the Splunk build in internal data model. Adopt it to your needs
@MuS
I am getting the following error
Error in 'TsidxStats': Could not find datamodel: internal_server
Make sure, you're in the search app and have admin rights.