The output of the tstats command won't work for trellis charts, only stats... why?

[murdermostfowl]

I really like the trellis feature for bar charts. It works great when I work from datamodels and use stats. However, when I use the tstats command to get better performance, even though the data appears be be exactly the same in the statistics tab, it does not render properly in Visualizations unless you redundantly pass it through stats:

| tstats summariesonly=true count from datamodel="Network_Traffic.All_Traffic" where All_Traffic.dest_port=22 by All_Traffic.dvc, All_Traffic.action 
| rename All_Traffic.dvc as Device, All_Traffic.action AS Action 

This does not work. This, however does work:

 tstats summariesonly=true count from datamodel="Network_Traffic.All_Traffic" where All_Traffic.dest_port=22 by All_Traffic.dvc, All_Traffic.action 
    | rename All_Traffic.dvc as Device, All_Traffic.action AS Action 
    |  stats sum(count) by Device, Action

( Then apply the visualization bar (or column) chart, independent scale, trellis, split by Device. )

The data output is visually identical, but I get the strong feeling there is a hidden datatype that stats is outputting that I can't see. The visualization shows the data as an aggregation and gives no other choices, but when you apply the stats, it suddenly recognizes 3 different things to split by. Whatever this secret formatting method is, is there a faster/more direct function to properly convert the fields so that you don't have to do this redundant stats command?

Thanks!

[sduff_splunk · Accepted solution]

You will need to use prestats mode with tstats, see https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Tstats

| tstats prestats=true summariesonly=true count from datamodel="Network_Traffic.All_Traffic" where All_Traffic.dest_port=22 by All_Traffic.dvc, All_Traffic.action 
| rename All_Traffic.dvc as Device, All_Traffic.action AS Action 
|  stats sum(count) by Device, Action

[murdermostfowl]

Thank you, this worked!