topic Re: Tstats command in Splunk Search

Tstats command

ecanmaster — Fri, 20 Oct 2017 12:40:28 GMT

Does anybody have a good documentation regarding on how to use tstats? I have mainly used "normal" searches but need to use tstats now.
The splunk documentation I have already read and it's not good (i think you need to know already a lot before reading any splunk documentation) . With normal searches you can define the indexes source types and also the data will show , so based on the data you can refine your search, how can I do the same with tstats ?

Re: Tstats command

elliotproebstel — Fri, 20 Oct 2017 12:49:21 GMT

I found this existing answer very helpful when I wanted to understand tstats:
https://answers.splunk.com/answers/186938/what-is-tstats-and-why-is-so-much-faster-than-stat.html

Re: Tstats command

DalJeanis — Mon, 23 Oct 2017 02:43:49 GMT

@ecanmaster - if elliot's comment has helped you with your question, then please accept the answer so that the question will show as closed. If you need more information, please let us know and we will give you more help.