https://community.splunk.com/t5/Splunk-Search/What-is-the-difference-between-the-metasearch-and-tstats/m-p/247210#M73746 <P>Adding to that, <CODE>metasearch</CODE> is often around two orders of magnitude slower than <CODE>tstats</CODE>.</P> <P>This takes 0.23 seconds on my PC: <CODE>| tstats count where index=_internal by source</CODE><BR /> This takes 29.4 seconds: <CODE>| metasearch index=_internal | stats count by source</CODE></P> <P>One thing <CODE>metasearch</CODE> can do that <CODE>tstats</CODE> can't: Discovery of indexed fields:</P> <PRE><CODE>| metasearch index=_internal | fieldsummary </CODE></PRE> <P><CODE>tstats</CODE> forces you to <CODE>stats</CODE> your data, while not allowing something like <CODE>values(*)</CODE> to peek into unknown data.</P> Thu, 25 Aug 2016 22:34:45 GMT martin_mueller 2016-08-25T22:34:45Z https://community.splunk.com/t5/Splunk-Search/What-is-the-difference-between-the-metasearch-and-tstats/m-p/247208#M73744 <P>I've been using tstats for most of the use cases that metasearch covers, and so I'm interested in what metasearch can do that tstats can't. From my reading of the documentation, it seems that metasearch is a subset of the capability of tstats (i.e. tstats can search over accelerated datamodels).</P> <P>Am I missing anything?</P> Thu, 25 Aug 2016 21:07:29 GMT https://community.splunk.com/t5/Splunk-Search/What-is-the-difference-between-the-metasearch-and-tstats/m-p/247208#M73744 muebel 2016-08-25T21:07:29Z https://community.splunk.com/t5/Splunk-Search/What-is-the-difference-between-the-metasearch-and-tstats/m-p/247209#M73745 <P>No.. that's pretty much it. metasearch was older way to query tsidx data (metadata fields). The tstats command is advanced/improved form of metasearch.</P> Thu, 25 Aug 2016 21:11:59 GMT https://community.splunk.com/t5/Splunk-Search/What-is-the-difference-between-the-metasearch-and-tstats/m-p/247209#M73745 somesoni2 2016-08-25T21:11:59Z https://community.splunk.com/t5/Splunk-Search/What-is-the-difference-between-the-metasearch-and-tstats/m-p/247210#M73746 <P>Adding to that, <CODE>metasearch</CODE> is often around two orders of magnitude slower than <CODE>tstats</CODE>.</P> <P>This takes 0.23 seconds on my PC: <CODE>| tstats count where index=_internal by source</CODE><BR /> This takes 29.4 seconds: <CODE>| metasearch index=_internal | stats count by source</CODE></P> <P>One thing <CODE>metasearch</CODE> can do that <CODE>tstats</CODE> can't: Discovery of indexed fields:</P> <PRE><CODE>| metasearch index=_internal | fieldsummary </CODE></PRE> <P><CODE>tstats</CODE> forces you to <CODE>stats</CODE> your data, while not allowing something like <CODE>values(*)</CODE> to peek into unknown data.</P> Thu, 25 Aug 2016 22:34:45 GMT https://community.splunk.com/t5/Splunk-Search/What-is-the-difference-between-the-metasearch-and-tstats/m-p/247210#M73746 martin_mueller 2016-08-25T22:34:45Z https://community.splunk.com/t5/Splunk-Search/What-is-the-difference-between-the-metasearch-and-tstats/m-p/247211#M73747 <P>The two are operators on a different level. <BR /> tstats -- all about stats. It does this based on fields encoded in the tsidx files. You can use this to result in rudimentary searches by just reducing the question you are asking to stats. It is however a reporting level command and is designed to result in statistics.</P> <P>metasearch -- this actually uses the base search operator in a special mode where we do not read from the journal.gz. So this is an event based command. We actually treat things as events. Due to the fact that we are not reading form the journal.gz this can only use information that exists in the tsidx files. </P> <P>Thus they are both tsidx based, however one is based on events and the other is based on statistics as a base object type.</P> Thu, 25 Aug 2016 23:50:04 GMT https://community.splunk.com/t5/Splunk-Search/What-is-the-difference-between-the-metasearch-and-tstats/m-p/247211#M73747 cpride_splunk 2016-08-25T23:50:04Z https://community.splunk.com/t5/Splunk-Search/What-is-the-difference-between-the-metasearch-and-tstats/m-p/247212#M73748 <P>thanks Martin! That fieldsummary bit is a good point.</P> Mon, 29 Aug 2016 13:46:17 GMT https://community.splunk.com/t5/Splunk-Search/What-is-the-difference-between-the-metasearch-and-tstats/m-p/247212#M73748 muebel 2016-08-29T13:46:17Z