The city just onboarded a new PSAP CAD sourcetype. An analyst runs tstats on the Authentication data model and sees none of the new events. Why?
Select an answer to reveal the explanation.
Short Explanation
tstats reads the CliffsNotes, not the whole book. A brand-new CAD sourcetype is not in those notes until the model includes it and acceleration catches up. That is a limitation, not a broken search.
Full Explanation
In Splunk Enterprise Security for a municipal SOC, tstats only returns data that exists in the accelerated data-model summaries. A newly onboarded PSAP CAD sourcetype will not appear in tstats on Authentication until it is mapped into the Authentication data model and acceleration has built summaries for those events—regardless of how urgently the city needs CAD visibility. Claiming tstats always ignores civic sourcetypes until a SOAR playbook backfills them fails by concept because SOAR is not the mechanism that populates data-model acceleration. Claiming tstats can only run after rex extracts every field from _raw in the same search fails by concept because tstats reads summary fields from the model, not ad-hoc rex in the same pipeline. Claiming tstats requires the notable index and will not read Authentication at all fails by concept because tstats targets data-model datasets such as Authentication, not the notable index. Exam caveat: SPLK-5001 expects analysts to know tstats’ dependency on mapping and acceleration when new civic sourcetypes are onboarded. Operational check: confirm the PSAP CAD sourcetype is tagged and mapped into Authentication (or the correct model), verify acceleration status and recent summary build time, re-run tstats for the CAD time window, and if events are still missing escalate mapping gaps rather than assuming tstats is broken.