Editorial question65.6K views4,846 votes0 answers3,953 following
AI-generatedIndexed fields with tstats versus search-time extraction for high-volume Splunk searches
In Splunk Enterprise, a high-volume search over large event volumes can be classified as scan-bound using the Search Job Inspector, which reports component-level execution costs and statistics such as scanCount . The unresolved decision is whether to extract the relevant fields at index time so tstats can query tsidx files directly, or to retain search-time
splunk