thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Advanced

tstats Command

An SPL command that performs fast statistical queries on indexed fields and accelerated data models.

Definition

tstats queries tsidx index files rather than raw events, making it dramatically faster for large datasets. It works on indexed fields (such as host, source, sourcetype) and accelerated data models like those in the Common Information Model. Splunk Enterprise Security correlation searches commonly use tstats.

Example

| tstats count from datamodel=Authentication where Authentication.action=failure by Authentication.src

Exam tip

Use tstats with accelerated data models for performance at scale.

Related terms