Installed splunk 6.2 and have a accelerated datamodel.
I tried the below query and getting "no results found".
|tstats count from datamodel=test prestats=t
i'm getting the result without prestats command. so please anyone tell me that when to use prestats command and its uses.
Prestats is used for visualization and needs other commands after |.
From tstats documentation:
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Tstats
prestats
Syntax: prestats=true | false
Description: Use this to output the answer in prestats format, which enables you to pipe the results to a different type of processor, such as chart or timechart, that takes prestats output. This is very useful for creating graph visualizations. Defaults to false.
Examples:
| tstats prestats=f count from datamodel=test
| tstats prestats=t count from datamodel=test | table psrsvd_gc | rename psrsvd_gc AS count