Splunk Search

The output of the tstats command won't work for trellis charts, only stats... why?

murdermostfowl
New Member

I really like the trellis feature for bar charts. It works great when I work from datamodels and use stats. However, when I use the tstats command to get better performance, even though the data appears be be exactly the same in the statistics tab, it does not render properly in Visualizations unless you redundantly pass it through stats:

| tstats summariesonly=true count from datamodel="Network_Traffic.All_Traffic" where All_Traffic.dest_port=22 by All_Traffic.dvc, All_Traffic.action 
| rename All_Traffic.dvc as Device, All_Traffic.action AS Action 

This does not work. This, however does work:

 tstats summariesonly=true count from datamodel="Network_Traffic.All_Traffic" where All_Traffic.dest_port=22 by All_Traffic.dvc, All_Traffic.action 
    | rename All_Traffic.dvc as Device, All_Traffic.action AS Action 
    |  stats sum(count) by Device, Action

( Then apply the visualization bar (or column) chart, independent scale, trellis, split by Device. )

The data output is visually identical, but I get the strong feeling there is a hidden datatype that stats is outputting that I can't see. The visualization shows the data as an aggregation and gives no other choices, but when you apply the stats, it suddenly recognizes 3 different things to split by. Whatever this secret formatting method is, is there a faster/more direct function to properly convert the fields so that you don't have to do this redundant stats command?

Thanks!

0 Karma
1 Solution

sduff_splunk
Splunk Employee
Splunk Employee

You will need to use prestats mode with tstats, see https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Tstats

| tstats prestats=true summariesonly=true count from datamodel="Network_Traffic.All_Traffic" where All_Traffic.dest_port=22 by All_Traffic.dvc, All_Traffic.action 
| rename All_Traffic.dvc as Device, All_Traffic.action AS Action 
|  stats sum(count) by Device, Action

View solution in original post

0 Karma

sduff_splunk
Splunk Employee
Splunk Employee

You will need to use prestats mode with tstats, see https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Tstats

| tstats prestats=true summariesonly=true count from datamodel="Network_Traffic.All_Traffic" where All_Traffic.dest_port=22 by All_Traffic.dvc, All_Traffic.action 
| rename All_Traffic.dvc as Device, All_Traffic.action AS Action 
|  stats sum(count) by Device, Action
0 Karma

murdermostfowl
New Member

Thank you, this worked!

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...