Splunk Search

How To Use tstats with nested data models - getting empty results

theironcook
Explorer

I have a DataModel named "AccessLogs" and it has a DataSet hierarchy that looks like this
RootSearchDS // sourcetype=http_access_log
BusinessHoursDS // Child of RootSearchDS, Some filtering to only include Mon-Fri work hours
BetaDS // Child of BusinessHoursDS, host=BetaServer*
ProdDS // Child of BusinessHoursDS, host=ProdServer*

I've enabled the DataModel to be publicly available and I've enabled acceleration for 1 day.

Now, I'm trying to use the tstats function to return some results about my DataSets. I'm running queries over around 1-2 Terrabytes of data collected over 3 months. The normal pivots are very slow - a few hours to run - so I was hoping the tstats function would provide a faster alternative. I just need basic stats on my DataSets - like avg values segmented by week of the year.

Here's my tstats command:

| tstats count avg(ResponseTimeMillis) as "AvgResponse" FROM datamodel=AccessLogs.RootSearchDS WHERE nodename=RootSearchDS.BusinessHoursDS.BetaDS by TimeWeekOfYear

I can see the count field is populated with data but the AvgResponse field is always blank. It looks like this field doesn't exist. But when I pivot off my data model AccessLogs > RootSearch > BusHours > Beta I can see that the ResponseTimeMillis field does exist.

Anyone know why the avg(ResponseTimeMillis) might be blank? Did I specify my "datamodel" and "nodename" parameters correctly? Does ResponseTimeMillis need to be set as a "required" field in my DataSet?

1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You need to prefix the field name with the data model name: avg(AccessLogs.ResponseTimeMillis)

View solution in original post

theironcook
Explorer

Thanks martin! Your answer led me to the correct one - almost right.

I need to append with my root search (not the data model name)

avg(RootSearchDS.ResponseTimeMillis)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You need to prefix the field name with the data model name: avg(AccessLogs.ResponseTimeMillis)

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...