Hi, I've gone through Splunk documentation but still struggle to find an official answer to my question. Given an accelerated data model, is there a difference in terms of performances and results between using the datamodel command and using the tstats command for querying that data model (assuming the summariesonly option isn't used) Use case 1: - The time range targeted has 100% summaries - My expectation: both commands will leverage summaries, return the same results, perform equally Uses case 2: - The time range targeted has say 80% summaries and the last 20% of the time range hasn't - My expectation: both commands will leverage summaries for the 80% chunk, query raw logs for the last 20%, return the same results, perform equally Use case 3: - The time range has no summaries - My expectation: both commands will query raw logs, return the same results, perform equally
... View more