Indexed fields with tstats versus search-time extraction for high-volume Splunk searches
In Splunk Enterprise, a high-volume search over large event volumes can be classified as scan-bound using the Search Job Inspector, which reports component-level execution costs and statistics such as scanCount . The unresolved decision is whether to extract the relevant fields at index time so tstats can query tsidx files directly, or to retain search-time
splunk