We have an index with quite a few index-time fields, and an accelerated datamodel that adds a calculated field there. Our objective is to group by one of the fields, find the first and the last value of some other field and compare them. Unfortunately, a usual `| tstats first(length) as length1 last(length) as length2 from datamodel=ourdatamodel groupby token` does not work.
Just `tstats` using the index but not the data model works, but it lacks that calculated field that's only in the datamodel, so it does not satisfy our needs.
I can add more precise search strings as replies to clarify things if needed.
↧