Splunk Search

stats automatically converts to tstats

marceloalejandr
Path Finder

Greetings Splunkers,

I recently attended Splunk Fundamentals 3 and the instructor mentioned about a Splunk feature that automatically converts stats commands to tstats in order to try to improve performance.  The instructor did not go into details but recommended I post the question to the Splunk Community.

Is there more information about this, i.e. the version this is or will be available in, etc? 

Will/can we see the conversion happen in the Job Inspector or noop?  

How does/will Splunk select which stats command to convert?   Is it only converting based on the metadata and indexed fields in the tsidx file OR will there be other criteria that tstats will convert?

Thanks in advance for any insight or help with this.

Labels (2)
0 Karma
Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...