topic Re: Tstats and stats return difference result in Splunk Search https://community.splunk.com/t5/Splunk-Search/Tstats-and-stats-return-difference-result/m-p/558427#M158628 <P>In my search commands the number of events queried are the same so i think the problem is not the data acceleration</P> Tue, 06 Jul 2021 14:40:07 GMT hoangpt 2021-07-06T14:40:07Z Tstats and stats return difference result https://community.splunk.com/t5/Splunk-Search/Tstats-and-stats-return-difference-result/m-p/558399#M158616 <DIV>Why do I use "tstats" and "stats" but return different results??? I need an explanation.</DIV><DIV>I use Splunk version 8.2.0<span class="lia-inline-image-display-wrapper lia-image-align-left" image-alt="image_2021_07_06T12_08_17_604Z.png" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/14948iC8585F584AB5249B/image-size/large?v=v2&amp;px=999" role="button" title="image_2021_07_06T12_08_17_604Z.png" alt="image_2021_07_06T12_08_17_604Z.png" /></span><span class="lia-inline-image-display-wrapper lia-image-align-left" image-alt="image_2021_07_06T12_08_05_632Z.png" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/14951iA2FBB6168E0F2D80/image-size/large?v=v2&amp;px=999" role="button" title="image_2021_07_06T12_08_05_632Z.png" alt="image_2021_07_06T12_08_05_632Z.png" /></span><span class="lia-inline-image-display-wrapper lia-image-align-left" image-alt="image_2021_07_06T12_07_27_843Z.png" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/14949i23275CB63BD6B8CD/image-size/large?v=v2&amp;px=999" role="button" title="image_2021_07_06T12_07_27_843Z.png" alt="image_2021_07_06T12_07_27_843Z.png" /></span><span class="lia-inline-image-display-wrapper lia-image-align-left" image-alt="image_2021_07_06T12_06_45_242Z.png" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/14952i7E5C5BF8E99409C2/image-size/large?v=v2&amp;px=999" role="button" title="image_2021_07_06T12_06_45_242Z.png" alt="image_2021_07_06T12_06_45_242Z.png" /></span></DIV> Tue, 06 Jul 2021 12:25:49 GMT https://community.splunk.com/t5/Splunk-Search/Tstats-and-stats-return-difference-result/m-p/558399#M158616 hoangpt 2021-07-06T12:25:49Z Re: Tstats and stats return difference result https://community.splunk.com/t5/Splunk-Search/Tstats-and-stats-return-difference-result/m-p/558421#M158623 <P>tstats returns data on indexed fields. In the case of datamodels (as in your example) this would be the accelerated portion of your datamodel so it's limited by the date range you configured.</P><P>stats returns all data on the specified fields regardless of acceleration/indexing. That is the reason for the difference you are seeing.</P> Tue, 06 Jul 2021 14:13:52 GMT https://community.splunk.com/t5/Splunk-Search/Tstats-and-stats-return-difference-result/m-p/558421#M158623 codebuilder 2021-07-06T14:13:52Z Re: Tstats and stats return difference result https://community.splunk.com/t5/Splunk-Search/Tstats-and-stats-return-difference-result/m-p/558423#M158625 <P>I know that. I searched for the data of many days ago but the result was still the same :(((&nbsp;</P> Tue, 06 Jul 2021 14:19:42 GMT https://community.splunk.com/t5/Splunk-Search/Tstats-and-stats-return-difference-result/m-p/558423#M158625 hoangpt 2021-07-06T14:19:42Z Re: Tstats and stats return difference result https://community.splunk.com/t5/Splunk-Search/Tstats-and-stats-return-difference-result/m-p/558424#M158626 <UL><LI>Can you take a closer look at the pictures. Even the values ​​of the Web.src field return no results</LI></UL> Tue, 06 Jul 2021 14:22:19 GMT https://community.splunk.com/t5/Splunk-Search/Tstats-and-stats-return-difference-result/m-p/558424#M158626 hoangpt 2021-07-06T14:22:19Z Re: Tstats and stats return difference result https://community.splunk.com/t5/Splunk-Search/Tstats-and-stats-return-difference-result/m-p/558427#M158628 <P>In my search commands the number of events queried are the same so i think the problem is not the data acceleration</P> Tue, 06 Jul 2021 14:40:07 GMT https://community.splunk.com/t5/Splunk-Search/Tstats-and-stats-return-difference-result/m-p/558427#M158628 hoangpt 2021-07-06T14:40:07Z Re: Tstats and stats return difference result https://community.splunk.com/t5/Splunk-Search/Tstats-and-stats-return-difference-result/m-p/558430#M158631 <P>Running tstats on a datamodel is dependent on the accelerated range. Only results that have been accelerated will be returned, regardless of the date/time picker selection.</P><P>Also, you are running two different queries in your examples. One for url_length and another for src.</P> Tue, 06 Jul 2021 14:43:58 GMT https://community.splunk.com/t5/Splunk-Search/Tstats-and-stats-return-difference-result/m-p/558430#M158631 codebuilder 2021-07-06T14:43:58Z