Splunk DMA: Why Your tstats Query is Slow (and How Acceleration Fixes It)

The tstats Performance Problem

If you're running tstats queries over large datasets and still seeing multi-minute runtimes, the issue is often Data Model Acceleration (DMA). The tstats command is designed to query pre-aggregated tsidx files, but without DMA enabled, it falls back to scanning raw events—negating its performance advantage.

How DMA Pre-computes tsidx Files

When DMA is enabled on a data model, Splunk creates additional tsidx files containing pre-aggregated summaries. These files are updated incrementally based on the acceleration schedule. Queries using summariesonly=t can then read from these summaries instead of processing millions of individual events.

Key configuration lives in datamodels.conf:

[Network_Traffic]
acceleration = 1
acceleration.backfill_time = 7d
acceleration.cron_schedule = */15 * * * *

Working Example: Network Traffic Analysis

Enable DMA on the Network_Traffic data model in Splunk Web (Settings > Data Models > Network_Traffic > Edit > Acceleration). Set a 7-day backfill time and 15-minute cron schedule.

After the build completes, run this query:

| tstats summariesonly=t count from datamodel=Network_Traffic where nodename=All_Traffic by _time span=1h

This should return results in seconds. Without DMA, the same query over a week of data might take minutes.

Trade-offs: Storage Overhead and Field Limitations

DMA typically adds 10-30% storage overhead per accelerated data model. High-cardinality fields like session IDs can cause tsidx explosion. Only fields defined in the data model's constraints are accelerated—ad-hoc eval

Queries spanning beyond the acceleration time range silently fall back to raw search. Always verify your time range covers the accelerated period.

Verification Steps

1. Check acceleration status: | datamodel Network_Traffic All_Traffic acceleration
2. Monitor build progress in index=_internal sourcetype=splunkd component=DataModelAcceleration
3. Compare query runtime with and without summariesonly=t

Actionable Takeaway

Enable DMA for any data model you query frequently with tstats. Start with a 7-day backfill and monitor storage impact. Always use summariesonly=t to guarantee acceleration. Plan schema changes during maintenance windows—they trigger full rebuilds that can take hours.