Splunk Search

When to use prestats command in tstats and its uses?

chitra
Explorer

Installed splunk 6.2 and have a accelerated datamodel.

I tried the below query and getting "no results found".
|tstats count from datamodel=test prestats=t

i'm getting the result without prestats command. so please anyone tell me that when to use prestats command and its uses.

Tags (1)

pedromvieira
Communicator

Prestats is used for visualization and needs other commands after |.
From tstats documentation:

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Tstats

prestats
Syntax: prestats=true | false
Description: Use this to output the answer in prestats format, which enables you to pipe the results to a different type of processor, such as chart or timechart, that takes prestats output. This is very useful for creating graph visualizations. Defaults to false.

Examples:

| tstats prestats=f count from datamodel=test 

| tstats prestats=t count from datamodel=test | table psrsvd_gc | rename psrsvd_gc AS count
Get Updates on the Splunk Community!

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...