I've been using tstats for most of the use cases that metasearch covers, and so I'm interested in what metasearch can do that tstats can't. From my reading of the documentation, it seems that metasearch is a subset of the capability of tstats (i.e. tstats can search over accelerated datamodels).
Am I missing anything?
No.. that's pretty much it. metasearch was older way to query tsidx data (metadata fields). The tstats command is advanced/improved form of metasearch.
Adding to that,
metasearch is often around two orders of magnitude slower than
This takes 0.23 seconds on my PC:
| tstats count where index=_internal by source
This takes 29.4 seconds:
| metasearch index=_internal | stats count by source
metasearch can do that
tstats can't: Discovery of indexed fields:
| metasearch index=_internal | fieldsummary
tstats forces you to
stats your data, while not allowing something like
values(*) to peek into unknown data.
The two are operators on a different level.
tstats -- all about stats. It does this based on fields encoded in the tsidx files. You can use this to result in rudimentary searches by just reducing the question you are asking to stats. It is however a reporting level command and is designed to result in statistics.
metasearch -- this actually uses the base search operator in a special mode where we do not read from the journal.gz. So this is an event based command. We actually treat things as events. Due to the fact that we are not reading form the journal.gz this can only use information that exists in the tsidx files.
Thus they are both tsidx based, however one is based on events and the other is based on statistics as a base object type.