Hi
I have created a basic datamodel called "TEST"
I try to query on this datamodel with tstats but the only piece of code which return value is :
| tstats count from datamodel=TEST
But i cant se the events related to this request
And if i try to be more explicit in my request like below, I have no results
| tstats count from datamodel=TEST where EventCode=100
So what is the problem?
Other question : what is the interest to use datamodel and pivot command since it's possible to query on a datamodel without SPL?
Thanks
Hi @jip31,
as you can read at https://docs.splunk.com/Documentation/Splunk/9.1.1/Knowledge/Aboutdatamodels , data models are tables containing the fields extracted from your events, but yu don't have the events, so youcannot see then in search results.
Data models are very useful because they are very fast in searching for fields.
they have a very fixed syntax in the order of options (as oter Splunk commands) so you have to put exactly the option in the required order.
Then when you use data model fields, you have to remember to use the datamodel name, so, in in your TEST datamodel you have the EventCode field, you have to use:
| tstats count from datamodel=TEST where TEST.EventCode=100
Datamodel are very important when you have structured data to have very fast searches on large amount of data.
Ciao.
Giuseppe
Hi Gcusello
I can see the fields extracted in my datamodel
And even if i use your search below I have no results
| tstats count from datamodel=TEST where TEST.EventCode=100
I have only results heriteld fields like host, sourcetype, source
it seems to be
I have also the message Datamodel 'TEST' had an invalid search, cannot get indexes to search