Splunk Search

tstats peformance issues: admin vs user

Path Finder

Hi Splunk experts,

I am running below query and the results get loaded much faster for admin users compared to regular users.
| tstats count from datamodel=Web where earliest=-7d latest=-15m index=************* by _time span=15m | sort -_time

Searches ran by admin gets completed in less than a minute and user searches runs for many hours. Please can someone help?


Tags (1)
0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...