stats command syntax details
The required syntax is in bold.
- [allnum = <boolean>] [delim = <"string">] [partitions = <num>]
- <aggregation> ...
- ( [<by-clause>] [span=<time-span>] )
The AS and BY keywords are displayed in uppercase in the syntax and examples to make the syntax easier to read. You can specify these keywords in uppercase or lowercase.
- Syntax: <aggregate-function> "("<field> [AS <field>] ) ["," <aggregate-function> "("<field> [AS <field>] ) ]...
- Description: A statistical aggregation function. The function can be applied to an eval expression, or to one or more fields. By default, the name of the field used in the output is the same as your aggregate function. For example, if your search is
... | stats sum(bytes)the field name in the output is
sum(bytes). Use the AS clause to place the result into a new field with a name that you specify, for example
... | stats sum(bytes) AS 'sum of bytes'.
- Syntax: allnum=<boolean>
- Description: If set to
true, computes numerical statistics on each field if and only if all of the values of that field are numerical.
- Default: false
- Syntax: BY <field> [span=<timespan>] ["," <field> [span=<timespan>] ]...
- Description: The name of one or more fields to group the results by. You can specify a time span to apply to the grouping. The <by-clause> returns one row for each distinct value in the <by-clause> fields. You cannot use the wildcard character to specify multiple fields with similar names. You must specify each field separately.
- Default: If no <by-clause> is specified, the
statscommand returns only one row, which is the aggregation over the entire incoming result set.
- Syntax: delim=<string>
- Description: Specifies how the values in the
values()functions are delimited.
- Default: A single space
- Syntax: partitions=<num>
- Description: If specified, partitions the incoming search results based on the <by-clause> fields for multithreaded reduce. The
partitionsargument runs the reduce step (in parallel reduce processing) with multiple threads in the same search process on the same machine. Compare that with parallel reduce that runs the reduce step in parallel on multiple machines.
- Default: 1
stats command overview
stats command usage
This documentation applies to the following versions of Splunk® Cloud Services: current