tstats with timchart

[mansel_scheffel]

Hi,

If I use tstats and timechart will the timechart slow down my search drastically(There is a ton of data so trying to be as efficient as possible)? I am trying to display changes over time in single value visual with a trend arrow up or down, without timechart the arrow does not show(currently using tstats by time with earliest and span etc).

Thanks

[esix_splunk · Accepted solution]

Stats is a transforming command and is processed on the search head side. Once you have run your tstats command, piping it to stats should be efficient and quick. Typically the big slow down is streaming of the search events from the indexing tier to the SH for aggregation and transformation.
Since you are using tstats, I am assuming youre using this against a normal indexed fields (as opposed to an accelerated data model.) As long as you understand what you are aggregating with tstats, using it in this way is efficient (and much faster then the traditional index=xxxx search..)
Check your search log and you can see where the most time incurred is and could look at ways to speed it up. Typically its either in streaming from the indexing tier or its in parsing where regular expressions are not performant.