×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
kyokkygo
Engager
Member since: ‎10-12-2022
‎10-31-2024
Community Statistics
Posts 2
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎10-12-2022
View All

Why does tstats not work with macros in child data...

by in Splunk Search
‎02-03-2023 02:42 AM
‎02-03-2023 02:42 AM
  I try use macros to get external indexes in child dataset VPN, but search with tstats on this dataset doesn't work.  Example of search:     | tstats values(sourcetype) as sourcetype from datamodel=authentication.authentication where nodename=authentication.VPN by nodename       But when I explicitly enumerate the indexes, then everything works! And also it work with macros when i use search:     | from datamodel ...     What's problem?  ... View more
Labels

How accelerate only one root dataset from datamode...

by in Splunk Search
‎01-23-2023 02:32 AM
‎01-23-2023 02:32 AM
Hi! I try to accelerate only one dataset in datamodel with multiple datasets. How i can do it through datamodel.conf or in web ui?  In webui i cant choose acceleration in edit drilldown( ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎10-31-2024 01:41 PM