Can someone explain the prestats option within tstats?

[lennys26]

Can someone explain the prestats option within tstats?

I have reread the docs a bunch of times but just don't find a clear explanation of what it does other than it is "designed to be consumed by commands that generate aggregate calculations".

Below I have 2 very basic queries which are returning vastly different results.

index="myindex" sourcetype="mysource" DRA=B*
| rex field=DRA "^(?<pfx>\D\S{1}).*" 
| timechart count by pfx useother=f limit=0 usenull=f

AND

| tstats prestats=t count where index="myindex" sourcetype="mysourcetype" DRA=B* by DRA, _time 
| rex field=DRA "^(?<pfx>\D\S{1}).*" 
| timechart count by pfx useother=f limit=0 usenull=f

I get it -- I must use prestats for the search using tstats but, then, what are the values that it IS returning without prestats? What is prestats doing? 

[richgalloway]

How different are the two results?  Which one is correct?

[lennys26]

@richgalloway - I just double checked my initial post and it looks like I pasted the wrong query, sorry.

The index search and the tstats search show the same results., while the tstats prestats=t search shows something different.

So the following two searches return the same results:

index="myindex" sourcetype="mysource" DRA=B*
| rex field=DRA "^(?<pfx>\D\S{1}).*" 
| timechart count by pfx useother=f limit=0 usenull=f

| tstats prestats=t count where index="myindex" sourcetype="mysourcetype" DRA=B* by DRA, _time 
| rex field=DRA "^(?<pfx>\D\S{1}).*" 
| timechart count by pfx useother=f limit=0 usenull=f

The following search (prestats=f) returns something vastly different:

| tstats count where index="myindex" sourcetype="mysourcetype" DRA=B* by DRA, _time 
| rex field=DRA "^(?<pfx>\D\S{1}).*" 
| timechart count by pfx useother=f limit=0 usenull=f

I suspect that the index and prestats=t results are correct, however I need to confirm.

[richgalloway · Accepted solution]

If two different searches produce the same results, then those results are likely to be correct.

I'm not very familiar with the inner workings of prestats, but understand it includes a few internal fields that timechart uses to produces its results.  With prestats=f, the timechart command is aggregating an aggregration, which isn't accurate - the same way you can't average averages.