The tstats command is used by the Pivot functionality of Splunk 6. That being the case, you probably can't find "User", "Bytes", Duration", or "Threats" in your sourcetype because they are created by the Data Model that was used by Pivot during the creation of the dashboard you are trying to "drill" into.
When building a Data Model in Slunk 6, you can create new fields using regular expressions, eval, lookups, etc. Also, during the configuration of the Data Model, you can choose display different field names than the ones in the data (i.e. the username field can be renamed to User).
Regarding your statement about finding the exact search, in this case, the search you posted is the exact search. Since it's using the Pivot and Data Model, you won't see the "behind-the-scenes" regexes, lookups, and/or evals used to create the fields you can't find in the data. Your ability to see the logic behind each field would depend on your user role and the Data Model permissions.
... View more