Optimizing Splunk Dashboards with the tstats Command
Learn how the Splunk tstats command bypasses raw event scanning to speed up dashboards by querying indexed fields and accelerated data model summaries.
Loading…
ReadMeFeed / Community knowledge
#tstats
Real questions. Useful conversations. Find the people who know your stack.
splunkStopping the Dashboard Spin: Using Data Model Acceleration to Fix Slow Splunk Searches
Stop waiting for slow Splunk dashboards. Learn how Data Model Acceleration (DMA) and the tstats command shift computational load from search-time to index-time for instant results.
Indexed fields with tstats versus search-time extraction for high-volume Splunk searches
In Splunk Enterprise, a high-volume search over large event volumes can be classified as scan-bound using the Search Job Inspector, which reports component-level execution costs and statistics such as scanCount . The unresolved decision is whether to extract the relevant fields at index time so tstats can query tsidx files directly, or to retain search-time