Splunk Search

When to use prestats command in tstats and its uses?

chitra
Explorer

Installed splunk 6.2 and have a accelerated datamodel.

I tried the below query and getting "no results found".
|tstats count from datamodel=test prestats=t

i'm getting the result without prestats command. so please anyone tell me that when to use prestats command and its uses.

Tags (1)

pedromvieira
Communicator

Prestats is used for visualization and needs other commands after |.
From tstats documentation:

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Tstats

prestats
Syntax: prestats=true | false
Description: Use this to output the answer in prestats format, which enables you to pipe the results to a different type of processor, such as chart or timechart, that takes prestats output. This is very useful for creating graph visualizations. Defaults to false.

Examples:

| tstats prestats=f count from datamodel=test 

| tstats prestats=t count from datamodel=test | table psrsvd_gc | rename psrsvd_gc AS count
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...