What is the performance impact of an extensive use of the tstats command?

[siva_cg]

Hi,

Will there be any impact on Splunk performance if we use tstats very extensively, like more than 10 panels in single dashboard? Thanks in advance.

[FrankVl · Accepted solution]

Any search has impact. Tstats is typically less impact-full than a search on raw data, but it still has impact.

If several panels in the dashboard use the same basic data, but present it in different ways, or do some specific statistics on it, it usually pays off to define a base search for your dashboard that gets the basic data that some/all panels need and then, in the panel, you only define the specific additional query to be added to that.

See: https://docs.splunk.com/Splexicon:Basesearch and http://docs.splunk.com/Documentation/Splunk/latest/Viz/Savedsearches#Post-process_searches