I'm trying to search my accelerated data model for process performance (standard CPU / MEM / IO). The data is standard linux / windows process data, but when I add the `summariesonly=true` there are no events. If I remove it, then I see events.
Query has results:
|tstats avg(All_Process_Performance.process_cpu_used_percent) as CPU FROM datamodel=process_performance groupby _time host
Query has NO results:
|tstats allow_old_summaries=true avg(All_Process_Performance.process_cpu_used_percent) as CPU FROM datamodel=process_performance groupby _time host
Here is a screen shot of the accelerated DM:
![alt text][1]
The Same is true of the standard **Splunk_SA_CIM** Performance data model. Both Data models are accelerated.
Query has results
|tstats avg(All_Performance.Memory.mem_used) as mem FROM datamodel=All_Performance groupby _time host
Query has NO results:
|tstats summariesonly=t avg(All_Performance.Memory.mem_used) as mem FROM datamodel=All_Performance groupby _time host
This is a screenshot of the accelerated DM as well:
![alt text][2]
Am I missing something, or doing something wrong? Any help would be appreciated.
[1]: /storage/temp/211608-process-dm.png
[2]: /storage/temp/211609-all-perf.png
↧