About joniba

joniba · ‎09-06-2023

Hey @PickleRick , I went into the settings for the dataset and enabled acceleration (via Edit Acceleration). Also the dataset shows up as accelerated in the list of datasets. Shouldn't that have resolved the issue? Also, why do you say it's irrelevant on a docker image? Is it not supposed to work on docker? Do you know of any documentation describing this?

joniba · ‎09-05-2023

I'm totally and utterly new to splunk. Just ran the dockerhub sample, and followed the instructions: https://hub.docker.com/r/splunk/splunk/ I opened the search tab and most search commands seem to work fine. For example, the following command: | from datamodel:"internal_server.server" | stats count Returns a count of 33350. While this command: | tstats count from datamodel:"internal_server.server" as well as this one: | tstats count both return zero. How can I get tstats working in this docker env with the sample datasets?

Posts	2
Solutions	0
Karma Given	1
Karma Received	0
Member Since	‎09-05-2023

Online Status	Offline
Date Last Visited	‎09-06-2023 07:02 PM

Why is tstats not working on docker image datasets...

Re: Why is tstats not working on docker image data...

Why is tstats not working on docker image datasets...