Why is the tstats command generally more efficient than using a stats command when searching over large data sets?

Question

Options

• Atstats is faster than stats since tstats only looks at the indexed metadata, whereas stats is
• Btstats is faster than stats since tstats is used in the beginning of the search pipeline,
• Ctstats is faster than stats since tstats searches the raw logs for search time extracted fields,
• Dtstats is faster than stats since tstats uses a search syntax that looks more like SQL,

• A
  94% (30)
• B
  3% (1)
• D
  3% (1)

Explanation

The tstats command queries Splunk’s time‑series index (tsidx) summaries and indexed metadata rather than scanning full raw events, drastically reducing I/O and improving performance on large

No community discussion yet for this question.