Splunk Search

When to use prestats command in tstats and its uses?

chitra
Explorer

Installed splunk 6.2 and have a accelerated datamodel.

I tried the below query and getting "no results found".
|tstats count from datamodel=test prestats=t

i'm getting the result without prestats command. so please anyone tell me that when to use prestats command and its uses.

Tags (1)

pedromvieira
Communicator

Prestats is used for visualization and needs other commands after |.
From tstats documentation:

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Tstats

prestats
Syntax: prestats=true | false
Description: Use this to output the answer in prestats format, which enables you to pipe the results to a different type of processor, such as chart or timechart, that takes prestats output. This is very useful for creating graph visualizations. Defaults to false.

Examples:

| tstats prestats=f count from datamodel=test 

| tstats prestats=t count from datamodel=test | table psrsvd_gc | rename psrsvd_gc AS count
Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...