https://community.splunk.com/t5/Splunk-Search/Converting-regular-query-to-tstats/m-p/625140#M217309 <P>I want to convert this query to tstats for faster searching&nbsp;<BR />can you help me convert it&nbsp;<BR /><BR />index=win-security host=srv001 user IN ("*adminuser")<BR />[ search index=paloalto sourcetype=pan:threat]</P> Thu, 29 Dec 2022 03:23:10 GMT leagawa 2022-12-29T03:23:10Z https://community.splunk.com/t5/Splunk-Search/Converting-regular-query-to-tstats/m-p/625140#M217309 <P>I want to convert this query to tstats for faster searching&nbsp;<BR />can you help me convert it&nbsp;<BR /><BR />index=win-security host=srv001 user IN ("*adminuser")<BR />[ search index=paloalto sourcetype=pan:threat]</P> Thu, 29 Dec 2022 03:23:10 GMT https://community.splunk.com/t5/Splunk-Search/Converting-regular-query-to-tstats/m-p/625140#M217309 leagawa 2022-12-29T03:23:10Z https://community.splunk.com/t5/Splunk-Search/Converting-regular-query-to-tstats/m-p/625146#M217311 <P>You can only use tstats on indexed fields, so unless the 'user' field is indexed, you cannot use tstats in the first parts of the search.</P><P>It's not entirely clear what you're trying to do with your subsearch. What are you trying to do there?</P><P>&nbsp;</P><P>&nbsp;</P> Thu, 22 Dec 2022 23:45:41 GMT https://community.splunk.com/t5/Splunk-Search/Converting-regular-query-to-tstats/m-p/625146#M217311 bowesmana 2022-12-22T23:45:41Z