Error in TsidxStats append is only valid for pre stats mode

[mcronkrite]

In Enterprise Security 3 on Splunk 6, have Websense data that has been tagged "web" and "proxy." Under Security Domains, Network, Web Center, the panels all come up except the bottom two. Top Sources and Top Destinations. The error displayed says "Error in TsidxStats': append is only valid for prestats mode. When I open either search I get the same message. When I pare the search down to not have the tstats append=true it runs fin. So I know the data model is populating. After searching for missing extractions I only have unknowns for status, http_content_type, http_refferer, and user. A fresh install of ES with event gen does not have the error.

[hazekamp]

mcronkrite,

Both the "Top Source" and "Top Destinations" panels on Web Center use the "| tstats" macro. This macro specifies prestats=true.

[tstats]
definition = tstats prestats=true local=`tstats_local` `summariesonly`

Since you mention that a fresh install doesn't have this error, do you by chance have a local override in place or Splunk_TA_opsec installed? If so, would recommend removing these from Splunk_TA_opsec/default/macros.conf because they are overriding the proper ones in SA-Utils:

[tstats]
definition = tstats local=`tstats_local` `summariesonly`

[tstats_local]
definition = false

[summariesonly]
definition = summariesonly=`summariesonly_bool`

[summariesonly_bool]
definition = true

[mcronkrite · Accepted solution]

Turns out the underlying search is wrong, you need to modify the search to add "prestats=true" in front of the "append=true" command. Works now.