The Alchemist's Lab • Room 3

Tstats vs Stats

The **tstats** command performs statistical queries strictly on *indexed fields* (like index, host, source, sourcetype) and Data Models.

Because it only reads the metadata TSIDX files (Time Series Index) instead of parsing raw data, `tstats` is extremely fast—often 100x faster than `stats`.

However, `tstats` CANNOT be used on fields extracted at search-time using rex or eval.

Knowledge Check

Prove your understanding to clear the room (Rewards XP)

Drag items to their correct zone (or tap item then tap zone on mobile)

Searches massive volumes of raw events

Uses TSIDX metadata files

Calculates based on index-time fields

Works with search-time rex extractions

tstats

stats