Splunk Search

Searching from a data model using tstats, why am I getting "Error in 'TsidxStats': Invalid root event object for datamodel"?

sushmitha_mj
Communicator

I created a data model "Aggregate". I added an object which is a root search object named "usage". There is a search that is written for this object which I can view when I go into the data model. I am having trouble searching from this data model.
The search I wrote:

| tstats max(Usage.field_value) from datamodel="Aggregate"

Where Usage is the root search object and Aggregate is data model name. I get the error

"Error in 'TsidxStats': Invalid root event object for datamodel "

How should I edit my search? Thanks in advance.

0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi sushmitha_mj,

did you create a root event for your data model? Data models are composed chiefly of object hierarchies built on root event objects, see the docs for more details http://docs.splunk.com/Documentation/Splunk/6.2.4/Knowledge/Designdatamodelobjects#Add_a_root_event_...

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi sushmitha_mj,

did you create a root event for your data model? Data models are composed chiefly of object hierarchies built on root event objects, see the docs for more details http://docs.splunk.com/Documentation/Splunk/6.2.4/Knowledge/Designdatamodelobjects#Add_a_root_event_...

cheers, MuS

sushmitha_mj
Communicator

@MuS
I was able to run the query | tstats values(server.licenser.quota.gb) AS gb from datamodel=internal_server by _time it gave me the Gb info against the time. Thanks

0 Karma

sushmitha_mj
Communicator

Thank @MuS

I added a root object with a constrain and the query now works. But I get no results and no error. How do I query to access my root search output?

0 Karma

MuS
SplunkTrust
SplunkTrust

try this run everywhere search:

| tstats values(server.licenser.quota.gb) AS gb from datamodel=internal_server by _time

This will get you the license quota from the Splunk build in internal data model. Adopt it to your needs

sushmitha_mj
Communicator

@MuS
I am getting the following error
Error in 'TsidxStats': Could not find datamodel: internal_server

0 Karma

MuS
SplunkTrust
SplunkTrust

Make sure, you're in the search app and have admin rights.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...