Splunk® Enterprise

Search Reference

Download manual as PDF

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

Statistical and charting functions

You can use the statistical and charting functions with the following commands:

The mstats and the tstats commands support a subset of the statistical and charting functions. Refer to the documentation for those commands for the exact list of supported functions.

Sparkline charts

The functions that you can use to create sparkline charts are noted in the documentation for each function. Sparkline is a function that applies to only the chart and stats commands, and allows you to call other functions. For more information, see Add sparklines to search results in the Search Manual.

How field values are processed

Most of the statistical and charting functions expect the field values to be numbers. All of the values are processed as numbers, and any non-numeric values are ignored.

Functions that process values as strings

The following functions process the field values as literal string values, even though the values are numbers.

  • count
  • distinct_count
  • earliest
  • estdc
  • estdc_error
  • first
  • latest
  • last
  • list
  • max
  • min
  • mode
  • values

For example, you use the distinct_count function and the field contains values such as "1", "1.0", and "01". Each value is considered a distinct string value.

The only exceptions are the max and min functions. These functions process values as numbers if possible. For example, the values "1", "1.0", and "01" are processed as the same numeric value.

Supported functions and syntax

The following table is a quick reference of the supported statistical and charting functions. This table lists the syntax and provides a brief description for each of the functions. Use the links in the table to learn more about each function examples, and to see examples.

Type of function Supported functions and syntax Description
Aggregate functions avg(X) Returns the average of the values in the field X.
count(X) Returns the number of occurrences where the field that you specify contains any value (is not empty. You can also count the occurrences of a specific value in the field by using the eval command with the count function. For example: count eval(field_name="value").
distinct_count(X) Returns the count of distinct values in the field X.
estdc(X) Returns the estimated count of the distinct values in the field X.
estdc_error(X) Returns the theoretical error of the estimated count of the distinct values in the field X. The error represents a ratio of the absolute_value(estimate_distinct_count - real_distinct_count)/real_distinct_count.
max(X) Returns the maximum value of the field X. If the values of X are non-numeric, the maximum value is found using lexicographical ordering. This function processes field values as numbers if possible, otherwise processes field values as strings.
mean(X) Returns the arithmetic mean of the field X.
median(X) Returns the middle-most value of the field X.
min(X) Returns the minimum value of the field X. If the values of X are non-numeric, the minimum value is found using lexicographical ordering.
mode(X) Returns the most frequent value of the field X.
perc<X>(Y) Returns the X-th percentile value of the numeric field Y. Valid values of X are integers from 1 to 99.


Additional percentile functions are upperperc<X>(Y) and exactperc<X>(Y).

range(X) Returns the difference between the maximum and minimum values of the field X ONLY IF the values of X are numeric.
stdev(X) Returns the sample standard deviation of the field X.
stdevp(X) Returns the population standard deviation of the field X.
sum(X) Returns the sum of the values of the field X.
sumsq(X) Returns the sum of the squares of the values of the field X.
var(X) Returns the sample variance of the field X.
varp(X) Returns the population variance of the field X.
Event order functions earliest(X) Returns the chronologically earliest (oldest) seen occurrence of a value of a field X.
first(X) Returns the first seen value of the field X. In general, the first seen value of the field is the most recent instance of this field, relative to the input order of events into the stats command.
last(X) Returns the last seen value of the field X. In general, the last seen value of the field is the oldest instance of this field relative to the input order of events into the stats command.
latest(X) Returns the chronologically latest (most recent) seen occurrence of a value of a field X.
Multivalue stats and chart functions list(X) Returns a list of up to 100 values of the field X as a multivalue entry. The order of the values reflects the order of input events.
values(X) Returns the list of all distinct values of the field X as a multivalue entry. The order of the values is lexicographical.
Time functions per_day(X) Returns the values of field X, or eval expression X, for each day.
per_hour(X) Returns the values of field X, or eval expression X, for each hour.
per_minute(X) Returns the values of field X, or eval expression X, for each minute.
per_second(X) Returns the values of field X, or eval expression X, for each second.

See also

Evaluation functions

stats, chart, timechart, eventstats, streamstats, geostats

Answers

Have questions? Visit Splunk Answers and search for a specific function or command.

PREVIOUS
Trig and Hyperbolic functions
  NEXT
Aggregate functions

This documentation applies to the following versions of Splunk® Enterprise: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5


Comments

Efavreau
Thank you for pointing this out! I have fixed the documentation.

Lstewart splunk, Splunker
January 12, 2018

Event order functions section, shows lastest(X) as a supported function. It's a typo, and should be latest(X).

Efavreau
January 9, 2018

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters