streamstats command syntax details
The required syntax is in bold.
- streamstats <aggregation> ...
The AS and BY keywords are displayed in uppercase in the syntax and examples to make the syntax easier to read. You can specify these keywords in uppercase or lowercase.
- Syntax: <aggregate-function> "("<field> [AS <field>] ) ["," <aggregate-function> "("<field> [AS <field>] ) ]...
- Description: A statistical aggregation function. The function can be applied to an eval expression, or to a field or set of fields. You can specify multiple aggregation functions. Separate each aggregation function with a comma.
- By default, the name of the field added to the output is the same as your function. For example, if your search is
... | streamstats avg(bytes)the field name in the output is
avg(bytes). Use the AS clause to place the generated result into a new field with a name that you specify, for example
... | streamstats avg(bytes) AS 'avg of bytes'.
- The syntax for the <aggregate-function> depends on the function that you use. See Stats and charting functions Quick Reference for information about the statistical functions.
- Syntax: BY <field-list>
- Description: The name of one or more fields to group the results by. The <by-clause> returns one row for each distinct value in the <by-clause> fields. Think of the <by-clause> as a grouping. You cannot use the wildcard character to specify multiple fields with similar names. You must specify each field separately.
- Default: If no <by-clause> is specified, the
streamstatscommand returns a running aggregation for each row in the incoming result set.
- Syntax: reset [before <eval-expression>] [after <eval-expression>] [onchange]
- Description: You can specify one or more reset condition. If multiple conditions are specified, the reset occurs when any of the conditions triggers a reset. See Usage.
- Default: No reset is applied to the results.
streamstats command overview
streamstats command usage
This documentation applies to the following versions of Splunk® Cloud Services: current