Splunk Search

What is the difference between the metasearch and tstats commands?

muebel
SplunkTrust
SplunkTrust

I've been using tstats for most of the use cases that metasearch covers, and so I'm interested in what metasearch can do that tstats can't. From my reading of the documentation, it seems that metasearch is a subset of the capability of tstats (i.e. tstats can search over accelerated datamodels).

Am I missing anything?

1 Solution

cpride_splunk
Splunk Employee
Splunk Employee

The two are operators on a different level.
tstats -- all about stats. It does this based on fields encoded in the tsidx files. You can use this to result in rudimentary searches by just reducing the question you are asking to stats. It is however a reporting level command and is designed to result in statistics.

metasearch -- this actually uses the base search operator in a special mode where we do not read from the journal.gz. So this is an event based command. We actually treat things as events. Due to the fact that we are not reading form the journal.gz this can only use information that exists in the tsidx files.

Thus they are both tsidx based, however one is based on events and the other is based on statistics as a base object type.

View solution in original post

cpride_splunk
Splunk Employee
Splunk Employee

The two are operators on a different level.
tstats -- all about stats. It does this based on fields encoded in the tsidx files. You can use this to result in rudimentary searches by just reducing the question you are asking to stats. It is however a reporting level command and is designed to result in statistics.

metasearch -- this actually uses the base search operator in a special mode where we do not read from the journal.gz. So this is an event based command. We actually treat things as events. Due to the fact that we are not reading form the journal.gz this can only use information that exists in the tsidx files.

Thus they are both tsidx based, however one is based on events and the other is based on statistics as a base object type.

martin_mueller
SplunkTrust
SplunkTrust

Adding to that, metasearch is often around two orders of magnitude slower than tstats.

This takes 0.23 seconds on my PC: | tstats count where index=_internal by source
This takes 29.4 seconds: | metasearch index=_internal | stats count by source

One thing metasearch can do that tstats can't: Discovery of indexed fields:

| metasearch index=_internal | fieldsummary

tstats forces you to stats your data, while not allowing something like values(*) to peek into unknown data.

muebel
SplunkTrust
SplunkTrust

thanks Martin! That fieldsummary bit is a good point.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

No.. that's pretty much it. metasearch was older way to query tsidx data (metadata fields). The tstats command is advanced/improved form of metasearch.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...