how to accelerate get timechart data from datamodel

[riat]

Hai, please I wanna ask how to accelerate to get timechart with datamodel from this query

| datamodel Intrusion_Detection IDS_Attacks search 
| search ("IDS_Attacks.src"="10.0.0.0/8" OR "IDS_Attacks.src"="172.16.0.0/12" OR "IDS_Attacks.src"="192.168.0.0/16") AND ("IDS_Attacks.severity"="high" OR "IDS_Attacks.severity"="critical")
| table _time,IDS_Attacks.category | timechart useother=`useother` count by IDS_Attacks.category

I have tried to use tstats but the data is not suitable because with tstats command there are some count data which are calculated to be just 1 event in so that timechart not clear, this tstats command I used before

| tstats allow_old_summaries=t count from datamodel=Intrusion_Detection.IDS_Attacks where ("IDS_Attacks.src"="10.0.0.0/8" OR "IDS_Attacks.src"="172.16.0.0/12" OR "IDS_Attacks.src"="192.168.0.0/16") AND ("IDS_Attacks.severity"="high" OR "IDS_Attacks.severity"="critical") by _time span=s IDS_Attacks.category | timechart useother=`useother` count by IDS_Attacks.category

thanks for your help before
best regard

[saravanan90]

This may help..

| tstats allow_old_summaries=t count from datamodel=Intrusion_Detection.IDS_Attacks where ("IDS_Attacks.src"="10.0.0.0/8" OR "IDS_Attacks.src"="172.16.0.0/12" OR "IDS_Attacks.src"="192.168.0.0/16") AND ("IDS_Attacks.severity"="high" OR "IDS_Attacks.severity"="critical") by _time span=s IDS_Attacks.category | timechart span=s useother=`useother` values(count) by IDS_Attacks.category | fillnull value=0

[to4kawa]

https://community.splunk.com/t5/Splunk-Search/When-to-use-prestats-command-in-tstats-and-its-uses/m-...

sample:

| tstats count where index=_internal sourcetype="splunk*" by _time span=1m prestats=true sourcetype
| timechart  count by sourcetype
| eval prestats="yes"
| append [| tstats count where index=_internal sourcetype="splunk*" by _time span=1m  sourcetype
| timechart  count by sourcetype
| eval prestats="no"]
| stats values(splunk*) as splunk* by _time prestats