Splunk Search

When to use prestats command in tstats and its uses?

chitra
Explorer

Installed splunk 6.2 and have a accelerated datamodel.

I tried the below query and getting "no results found".
|tstats count from datamodel=test prestats=t

i'm getting the result without prestats command. so please anyone tell me that when to use prestats command and its uses.

Tags (1)

pedromvieira
Communicator

Prestats is used for visualization and needs other commands after |.
From tstats documentation:

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Tstats

prestats
Syntax: prestats=true | false
Description: Use this to output the answer in prestats format, which enables you to pipe the results to a different type of processor, such as chart or timechart, that takes prestats output. This is very useful for creating graph visualizations. Defaults to false.

Examples:

| tstats prestats=f count from datamodel=test 

| tstats prestats=t count from datamodel=test | table psrsvd_gc | rename psrsvd_gc AS count
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...