Splunk tstats

| tstats count where index=main by _time

Counts events over Splunk summaries with tstats, the high-performance search for metrics and trends without touching raw events.

Run it when you need to count events at high speed over already indexed data: tstats works on the index summaries (TSIDX) instead of raw events, making it orders of magnitude faster than stats for simple counts and groupings. It's the backbone of volume dashboards (events per hour, per index, per host) and continuously running trend searches. In a SOC, the tstats count where index=main by _time pattern is the skeleton of SIEM health views and anomalous volume alerts — detecting a spike in events from a host can be the signal of an attack or a broken agent.

Don't use it when you need the values of events or non-summarized fields: tstats doesn't search raw content — it only counts and groups over indexed fields. For content filters (a string in the message), you need the normal search. And watch out for syntax: tstats' where accepts only indexed fields and summary functions; trying to filter by a field extracted at search time (a prior eval or rex) fails. On indexes without built summaries (old data without TSIDX), tstats returns empty — verify with the data accelerator that the summary exists for the range.