- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Not sure what I am doing wrong. I have a datamodel with a dataset that I can pivot on a field when using the datamodel explorer. When I try to use |tstats it does not work.
I get results as expected with
| tstats count as order_count from datamodel=spc_orders
however if I try and pivot
| tstats count as order_count from datamodel=spc_orders where state="CA"
0 results.
Whats going on here?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I figured this out. I had 2 data sets in my model and when I was specifying the datamodel=XXX, I didnt pass a dataset after. So by default this will assume the first listed dataset and work. When I was trying to run the query associated with the other dataset it wouldnt.
Simply adding the dataset name as an argument got it working.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

You need to use proper field name. Prepended by the dataset name.
Don't know your datamodel but as an example, with one of CIM datamodels.
It's not
| tstats count from datamodel=Network_Traffic by src_ip
but
| tstats count from datamodel=Network_Traffic by All_Traffic.src_ip
Of course you need to adjust it to your datamodel.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I figured this out. I had 2 data sets in my model and when I was specifying the datamodel=XXX, I didnt pass a dataset after. So by default this will assume the first listed dataset and work. When I was trying to run the query associated with the other dataset it wouldnt.
Simply adding the dataset name as an argument got it working.
