The city just onboarded a new PSAP CAD sourcetype. An analyst runs tstats on the Authentication data model and sees none of the new events. Why?
Select an answer to reveal the explanation.
Short Explanation
tstats reads the CliffsNotes, not the whole book. A brand-new CAD sourcetype is not in those notes until the model includes it and acceleration catches up. That is a limitation, not a broken search.
Full Explanation
tstats queries tsidx summaries for datasets that are in an accelerated data model. Newly onboarded sourcetypes do not appear until they are mapped into the model and acceleration has built summaries. This is a known limitation analysts must account for during investigations. SOAR backfill, a prior rex, or the notable index are not how tstats becomes complete.