What is the purpose of TSTATS in a Summary Index?

[mansel_scheffel]

Hi,

Quick question, is it possible, or is there any point to using tstats over stats when creating a summary index? Ultimately the reporting search will need to use a single value visual with a trendline based on changes over time..

Thanks

[somesoni2]

I would suggest to use tstats (if it's something suitable for your requirement, considering the fact tstats only works on indexed fields, not the search time extracted fields) over stats for summary index searches. The SI searches run frequently and it would be good for health of your Splunk system to run the most efficient searches.
In your report/dashboard which is using the summary index data, there will be no difference as the format of data stored in SI is same, but you'll save resources on background SI searches.

[skoelpin · Accepted solution]

Yes there is a huge speed advantage of using tstats compared to stats.. You can only use tstats when the data has been re-indexed in your summary index since tstats can only look at indexed metadeta.. This will include sourcetype , host , source , and _time ..

So if your search looks like this

index=foo .. | tstats count by index source sourcetype then it will be much much faster than using stats

But if your field looks like this

index=foo .. | tstats count where myField>100 by account then tstats will not work because myField and account are not index-time fields

It is possible to use tstats with search time fields but theres a lot of extra steps

[RR5027153]

thanks . this is helpful information . can you please provide more detail on how tstats can be used with search time fields and will there any advantage over stats command when using search time fields in tstats