How to count the logs quickly that with eventtypes

[xsstest]

I have an eventtype, but I want to count number of eventtype from nginx access log . then show on dashboard.

eventtype web_spider :

ua="spider" OR uri="spider" OR ua="bot" OR ua="monitor"

But nginx has a lot of logs , if use index=nginx eventtype="web_spider"|stats count,search speed will be very slow. Could I use tstats command to count ?

[mayurr98 · Accepted solution]

yes you can use tstats command but you would need to build a datamodel for that.
Refer this for creating a data model
http://docs.splunk.com/Documentation/Splunk/7.0.1/PivotTutorial/Buildtutorialdatamodel

After creating a datamodel you can use tstats command

| tstats count FROM datamodel=<datamodel_name> where index=nginx eventtype="web_spider"

If you have a single query that you want it to run faster then you can try report acceleration as well.

Save a search index=nginx eventtype="web_spider"|stats count as report and then refer below link to do report acceleration
http://docs.splunk.com/Documentation/Splunk/7.0.2/Report/Acceleratereports

let me know if this helps!

[xsstest]

thank you very much ~I am a SPLUNK novice

[logloganathan]

very good answer...