MENU
When working with an accelerated data model acc_datmodel and an unaccelerated data model unacc_datmodel, what tstats query could be used to search one of these data models?
The tstats command in Splunk is optimized for performance and is typically used with accelerated data models. The summariesonly parameter determines whether the search should use only the summarized (accelerated) data or fall back to raw data if necessary.
Setting summariesonly=false allows the search to use both summarized and raw data, making it suitable for both accelerated and unaccelerated data models.
Setting summariesonly=true restricts the search to only summarized data, which would result in no data returned if the data model is not accelerated.
Therefore, to search an accelerated data model and allow fallback to raw data if needed, the correct query is:
| tstats count from datamodel=acc_datmodel summariesonly=false
tstats - Splunk Documentation