Splunk Search

When to use prestats command in tstats and its uses?

chitra
Explorer

Installed splunk 6.2 and have a accelerated datamodel.

I tried the below query and getting "no results found".
|tstats count from datamodel=test prestats=t

i'm getting the result without prestats command. so please anyone tell me that when to use prestats command and its uses.

Tags (1)

pedromvieira
Communicator

Prestats is used for visualization and needs other commands after |.
From tstats documentation:

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Tstats

prestats
Syntax: prestats=true | false
Description: Use this to output the answer in prestats format, which enables you to pipe the results to a different type of processor, such as chart or timechart, that takes prestats output. This is very useful for creating graph visualizations. Defaults to false.

Examples:

| tstats prestats=f count from datamodel=test 

| tstats prestats=t count from datamodel=test | table psrsvd_gc | rename psrsvd_gc AS count
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...