Splunk Search

Why does tstats works different for root event datasets within the same data model

att35
Builder

Hi.

I have a data model that consists of two root event datasets. Both accelerated using simple SPL.

First dataset I can access using the following

 

| tstats summariesonly=t count FROM datamodel=model_name 
where nodename=dataset_1 by dataset_1.FieldName

 

But for the 2nd root event dataset, same format doesn't work. For that, I get events only by referencing the dataset along with the datamodel.

 

| tstats summariesonly=t count FROM datamodel=model_name.dataset_2 
by dataset_2.FieldName

 

e.g., the following will not work.

 

| tstats summariesonly=t count FROM datamodel=model_name 
where nodename=dataset_2 by dataset_2.FieldName

 

 

I am trying to understand what causes splunk search to work differently on these datasets when both are at the same level?

Thanks,

~ Abhi

Labels (1)
Tags (2)
0 Karma
Get Updates on the Splunk Community!

.conf23 Registration is Now Open!

Time to toss the .conf-etti 🎉 —  .conf23 registration is open!   Join us in Las Vegas July 17-20 for ...

Don't wait! Accept the Mission Possible: Splunk Adoption Challenge Now and Win ...

Attention everyone! We have exciting news to share! We are recruiting new members for the Mission Possible: ...

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...