Splunk Search

tstats unable to get any results when specifying dataset in FROM clause



We are in the process of migrating all Apps/Config's from an older standalone instance( to a newer SHC(8.1.1). A datamodel was also migrated along with the App and appears to be working fine in terms of acceleration statistics. But when I try to access using tstats, format that worked previously returns nothing.

| tstats summariesonly=t count FROM datamodel="modelname.dataset" by dataset.field


But if I do not mention dataset in the FROM cause, it works just fine.

| tstats summariesonly=t count FROM datamodel="modelname" by dataset.field


Could I have missed something during the migration? What could be causing the previous command to not work.

Labels (1)
Tags (2)
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!