Splunk Search

tstats peformance issues: admin vs user

Path Finder

Hi Splunk experts,

I am running below query and the results get loaded much faster for admin users compared to regular users.
| tstats count from datamodel=Web where earliest=-7d latest=-15m index=************* by _time span=15m | sort -_time

Searches ran by admin gets completed in less than a minute and user searches runs for many hours. Please can someone help?


Tags (1)
0 Karma
Get Updates on the Splunk Community!

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...