Splunk Search

Is it possible to perform a tstats from an accelerated savedsearch?

ericg57
Engager

I am asking because I attempted to use "savedsearch=" as a command after a | tstats much like calling a "datamodel=" , and I now see that the "savedsearch=" is highlighhted as if it should be as if it is an accepted command.

|tstats savedsearch=mysavedsearch

Tags (1)
0 Karma

vinod94
Contributor

Hi @ericg57 ,

You can run a Report Name through savedsearch command. You can make it work like this.

| savedsearch "Report Name"

You can also use tstats in a "Report Name" (ie in the search query of Report) and then call it from savedsearch.

For better understanding of savedsearch=

you can check this doc ... hope this clears your concern

https://docs.splunk.com/Documentation/Splunk/7.2.4/SearchReference/Loadjob

0 Karma

ericg57
Engager

Correction: and I now see that the "savedsearch=" is highlighhted as if it should be an accepted command.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...