Is this search just counting the number of events in this datamodel?

[Justin1224]

This is the search:

| tstats count from datamodel=Authentication where nodename=Authentication.Privileged_Authentication by _time span=1h | timechart span=1h count

Is this search counting the number of events in the "Priviliged_Aunthentication" node from the datamodel "Authentication" grouped into 1 hour periods?

[inventsekar · Accepted solution]

"Authentication" is the object name. The "nodename" on tstats is not hostname. It is to specify the node-name of the object hierarchy on CIM model.
More info about nodename.
https://docs.splunk.com/Documentation/Splunk/6.4.3/SearchReference/Tstats

An accelerated data model object
When you select data within an accelerated data model, you can further constrain your search by indicating an object within that data model that you want to select data from. You do this by using a where clause to indicate the nodename of the data model object. The nodename value indicates where the object is in a data model hierarchy.

When you use nodename in a search, you always use the following construction: FROM datamodel= where nodename=..<...>..

For example, say you want to search on an object named scheduled_reports in your internal_server data model. In that data model, the scheduled_reports object is a child of the scheduler object, which in turn is a child of the server root event object. This means that you should represent the scheduled_report object in your search as nodename=server.scheduler.scheduled_reports.

If you run that search and decide you want to search on the contents of the scheduler data model object instead, you would use nodename=server.scheduler in your new search.

[Justin1224]

Right, so the search is doing what I described then?

[sundareshr]

You're right. However, the last timechart is not needed