help on tsats command with datamodel

[jip31]

Hi

I have created a basic datamodel called "TEST"

I try to query on this datamodel with tstats but the only piece of code which return value is :

| tstats count from datamodel=TEST

 But i cant se the events related to this request

And if i try to be more explicit in my request like below, I have no results

| tstats count from datamodel=TEST where EventCode=100

 So what is the problem?

Other question : what is the interest to use datamodel and pivot command since it's possible to query on a datamodel without SPL?

Thanks

[gcusello]

Hi @jip31,

as you can read at https://docs.splunk.com/Documentation/Splunk/9.1.1/Knowledge/Aboutdatamodels , data models are tables containing the fields extracted from your events, but yu don't have the events, so youcannot see then in search results.

Data models are very useful because they are very fast in searching for fields.

they have a very fixed syntax in the order of options (as oter Splunk commands) so you have to put exactly the option in the required order.

Then when you use data model fields, you have to remember to use the datamodel name, so, in in your TEST datamodel you have the EventCode field, you have to use:

| tstats count from datamodel=TEST where TEST.EventCode=100

Datamodel are very important when you have structured data to have very fast searches on large amount of data.

Ciao.

Giuseppe

[jip31]

Hi Gcusello

I can see the fields extracted in my datamodel

And even if i use your search below I have no results

| tstats count from datamodel=TEST where TEST.EventCode=100

I have only results heriteld fields like host, sourcetype, source

[gcusello]

Hi @jip31,

are you sure that data are in your datamodel?

test this using pivot.

Ciao.

Giuseppe

[jip31]

it seems to be

I have also the message Datamodel 'TEST' had an invalid search, cannot get indexes to search