Tstats and stats return difference result

[hoangpt]

Why do I use "tstats" and "stats" but return different results??? I need an explanation.

I use Splunk version 8.2.0

[codebuilder · Accepted solution]

tstats returns data on indexed fields. In the case of datamodels (as in your example) this would be the accelerated portion of your datamodel so it's limited by the date range you configured.

stats returns all data on the specified fields regardless of acceleration/indexing. That is the reason for the difference you are seeing.

[hoangpt]

In my search commands the number of events queried are the same so i think the problem is not the data acceleration

[hoangpt]

• Can you take a closer look at the pictures. Even the values ​​of the Web.src field return no results

[hoangpt]

I know that. I searched for the data of many days ago but the result was still the same :((( 

[codebuilder]

Running tstats on a datamodel is dependent on the accelerated range. Only results that have been accelerated will be returned, regardless of the date/time picker selection.

Also, you are running two different queries in your examples. One for url_length and another for src.