Splunk Search

What is the difference between `tstats` and tstats?

thom_larner
Engager

Hi all,

I'm trying to build a simple dashboard that shows a simple graph of bytes sent by a web server. I realize that I want to use the "Web" accelerated data model, or the searches will take a long time.

After looking at the "Web Center" dashboard, and some tinkering, I arrived at this search:

| `tstats` sum(Web.bytes) from datamodel=Web by _time | timechart sum(Web.bytes)

This search works a treat, and runs very quickly. However, the output shows the raw byte count, which is hard to read. I would like to output Gb instead. So, after some more tinkering, I arrived at this search:

| tstats sum("Web.bytes") as "total_bytes" FROM datamodel=Web by _time | timechart eval(sum(total_bytes)/(1024*1024*1024)) as "GB out"

This search shows exactly what I want, but runs very slowly. It seems that the difference is `tstats` vs tstats, i.e. quotes vs. no quotes. If I remove the quotes from the first search, then it runs very slowly. And if I add the quotes to the second search, it runs much faster, but no results are found, so it seems that `tstats` has different semantics when it comes to applying functions such as eval.

So I have two questions, the first being about the difference between `tstats` and tstats, and why there is such a big performance difference. The second question is why `tstats` seems to not have some functions available.

I realize I'm probably missing something really obvious!

Thanks for your help.

Cheers,

Thom.

Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

A name within backticks is a macro. You should be able to find the definition of the macro at Settings->Advanced Search->Search macros.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

A name within backticks is a macro. You should be able to find the definition of the macro at Settings->Advanced Search->Search macros.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...