A data model is created with root search dataset and is set to acceleration as well.
rootsearchquery1 : index=abc sourcetype=xyz field_1="1"
rootsearchquery2 : index=abc sourcetype=xyz field_1="1" | fields _time field_2 field_3
For both the queries, auto extracted fields are added. ( _time, field_2, field_3).
These are general questions for better understanding, I would like to get suggestions in which scenario which usage (tstas, datamodel, root event , root search with streaming command, root search without streaming command) is preferrable?
1. |datamodel datamodelname datasetname | stats count by field_3
For Query 1, the output is pretty fast just below 10 seconds. (root search with out streaming command)
For Query 2, the output is more than 100 seconds. (root search with streaming command)
2. For Query 2, tstats command is also taking more than 100 seconds and only giving results when added summariesonly=false, why is it not giving results when summariesonly=true is added?
For Query 1, it works both summariesonly=false and true , and the output is pretty fast less than 2 seconds actually.
So, in what scenario is it mentioned that streaming commands in root search can be added and accerlated, when in return it is querying by adding fields twice which is becoming more inefficient?
eg : This is for Query 2
| datamodel datamodelname datasetname
| stats count by properties.ActionType
underlying query that is running :
(index=* OR index=_*) index=abc sourcetype="xyz" field_1="1" _time=* DIRECTIVES(READ_SUMMARY(datamodel="datamodelname.datasetname" summariesonly="false" allow_old_summaries="false"))
| fields "_time" field_2 field_3
| search _time = *
| fields "_time" field_2 field_3
| stats count by properties.ActionType
3. And in general what is recommended
- when a datamodel is accerlated, using either of them | datamodel or | tstats gives better performance.
- when a datamodel is not accerlated, using | tstats only gives better performance.
Is this correct?
4. And when a datamodel is not accerlated, the command | datamodel pulls the data from _raw buckets, then what is the use of querying the data using datamodel instead of direct index? When the performance is same?
5. And while querying | datamodel datamodelname datasetname why is splunk by default adding ( index=* and index=_*)? It can be changed?