TSTATS where error

[jwalzerpitt]

I am trying to run the following tstats search:

| tstats summariesonly=true estdc(Malware_Attacks.dest) as "infected_hosts" where "Malware_Attacks.action=allowed" from datamodel="Malware"."Malware_Attacks" 
| where 'infected_hosts'>100 
| eval const_dedup_id="const_dedup_id"

but I get the error:

Error in 'TsidxStats': WHERE clause is not an exact query

Any help would be appreciated

Thx

[nickhills · Accepted solution]

it's "from where", as opposed to "where from"
Thus:
| tstats summariesonly=true estdc(Malware_Attacks.dest) as "infected_hosts" from datamodel="Malware"."Malware_Attacks" where "Malware_Attacks.action"=allowed

[jwalzerpitt]

That was it - TYVM

[nickhills]

If my answer helped, please consider accepting and/or upvoting so that other memebers of the community can see it was useful.

[lakshman239]

Pls change to | tstats summariesonly=true estdc(Malware_Attacks.dest) as "infected_hosts" from datamodel="Malware"."Malware_Attacks" where "Malware_Attacks.action=allowed groupby Malware_Attacks.src

[OsmanElyas]

| tstats summariesonly=true sum(log.bytes) as MBytes_transferred from datamodel="ftnt_fos" where nodename="log.traffic" $srcip$ $dstip$ $user$ $app$ $vdom$ $device$ $srcintf$ $dstintf$ groupby log.user | eval MBytes_transferred = (MBytes_transferred/(1024*1024)) | sort -MBytes_transferred | head 10