Splunk Search

Error when trying to search Network Traffic data model with tstats

jwalzerpitt
Influencer

I am trying to search the Network Traffic data model, specifically blocked traffic, as follows:

| tstats summariesonly=true allow_old_summaries=true count from datamodel="Network_Traffic"."All_Traffic"."Traffic_By_Action"."Blocked_Traffic"

and I get the following error:

Error in 'DataModelCache': Invalid or unaccelerable root object for datamodel

Am I not chaining the child objects correctly in the search?

Thx

Labels (1)
Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The datamodel keyword takes only the root datamodel name.  To specify a dataset within the DM, use the nodename option.  See https://docs.splunk.com/Documentation/Splunk/8.0.6/SearchReference/Tstats#:~:text=indicating,model

| tstats summariesonly=true allow_old_summaries=true count from datamodel="Network_Traffic" where nodename="All_Traffic"."Traffic_By_Action"."Blocked_Traffic"
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The datamodel keyword takes only the root datamodel name.  To specify a dataset within the DM, use the nodename option.  See https://docs.splunk.com/Documentation/Splunk/8.0.6/SearchReference/Tstats#:~:text=indicating,model

| tstats summariesonly=true allow_old_summaries=true count from datamodel="Network_Traffic" where nodename="All_Traffic"."Traffic_By_Action"."Blocked_Traffic"
---
If this reply helps you, Karma would be appreciated.

jwalzerpitt
Influencer

@richgalloway

Thx for the reply and the info.

When I ran the query 

| tstats summariesonly=true allow_old_summaries=true count from datamodel="Network_Traffic" WHERE nodename="All_Traffic"."Traffic_By_Action"."Blocked_Traffic"

I got the following error: Error in 'TsidxStats': WHERE clause is not an exact query

 Thx

Tags (2)
0 Karma

jwalzerpitt
Influencer

Figured out the issue after banging away for a little - I had to drop the quotes from the nodenames

 

| tstats summariesonly=true allow_old_summaries=true count from datamodel="Network_Traffic" WHERE nodename=All_Traffic.Traffic_By_Action.Blocked_Traffic BY _time span=1h

 

Get Updates on the Splunk Community!

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...

Cisco Use Cases, ITSI Best Practices, and More New Articles from Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Build Your First SPL2 App!

Watch the recording now!.Do you want to SPL™, too? SPL2, Splunk's next-generation data search and preparation ...