Searching from a data model using tstats, why am I getting "Error in 'TsidxStats': Invalid root event object for datamodel"?

[sushmitha_mj]

I created a data model "Aggregate". I added an object which is a root search object named "usage". There is a search that is written for this object which I can view when I go into the data model. I am having trouble searching from this data model.
The search I wrote:

| tstats max(Usage.field_value) from datamodel="Aggregate"

Where Usage is the root search object and Aggregate is data model name. I get the error

"Error in 'TsidxStats': Invalid root event object for datamodel "

How should I edit my search? Thanks in advance.

[MuS · Accepted solution]

Hi sushmitha_mj,

did you create a root event for your data model? Data models are composed chiefly of object hierarchies built on root event objects, see the docs for more details http://docs.splunk.com/Documentation/Splunk/6.2.4/Knowledge/Designdatamodelobjects#Add_a_root_event_...

cheers, MuS

[sushmitha_mj]

@MuS
I was able to run the query | tstats values(server.licenser.quota.gb) AS gb from datamodel=internal_server by _time it gave me the Gb info against the time. Thanks

[sushmitha_mj]

Thank @MuS

I added a root object with a constrain and the query now works. But I get no results and no error. How do I query to access my root search output?

[MuS]

try this run everywhere search:

| tstats values(server.licenser.quota.gb) AS gb from datamodel=internal_server by _time

This will get you the license quota from the Splunk build in internal data model. Adopt it to your needs

[sushmitha_mj]

@MuS
I am getting the following error
Error in 'TsidxStats': Could not find datamodel: internal_server

[MuS]

Make sure, you're in the search app and have admin rights.