Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

tstat is not working! #125

Open
keroro824 opened this issue Apr 15, 2014 · 4 comments
Open

tstat is not working! #125

keroro824 opened this issue Apr 15, 2014 · 4 comments

Comments

@keroro824
Copy link
Collaborator

eg.

'tstats max(time) FROM datamodel=Web'

even this simple one.

@salspaugh
Copy link
Owner

Ok, I'll look into this one. The tstats tests seem to pass, so can you provide me a list of tstat invocations that are not working?

@keroro824
Copy link
Collaborator Author

Like:
tstats summariesonly min(_time) as firstTime,max(_time) as lastTime from datamodel=Authentication where Authentication.app!=unknown by Authentication.app

I tried to delete different fields of tstats here to see which one caused the error. It seems that "datamodel=Authentication", "Authentication.app!=unknown", "by Authentication.app" have problems.

@salspaugh
Copy link
Owner

"datamodel" is another Splunk command, so that makes sense that it doesn't work -- that should be fixed by PR #119. I think the period character is the source of the problem for the other case. A period is a concatenation operator with the eval commands so it has to be tokenized differently for those cases (it has to cause a token break). I use this eval-compatible approach with *stats commands because I think stats can sometimes be called with eval functions? Or some of them can anyway -- can't remember exactly. But maybe this will finally cause this approach to break. This could be a really difficult fix to make -- how many queries with tstats with "." are there?

@keroro824
Copy link
Collaborator Author

I remembered there are a lot, over 200 or something. So I thought tstat is not working. But I checked through them just now and found that period and datamodel seem to be the fields that most of them are in common.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants