stats command examples
The following are examples for using the SPL2
To learn more about the
stats command, see How the SPL2 stats command works.
Many of these examples use the statistical functions. See Overview of SPL2 stats and chart functions.
The AS and BY keywords are displayed in uppercase in the syntax and examples to make the syntax easier to read. You can specify the AS and BY keywords in uppercase or lowercase in your searches.
1. Calculate the sum of a field
If you just want a simple calculation, you can specify the aggregation without any other arguments. For example:
... | stats sum(bytes)
This search summarizes the bytes for all of the incoming results. One row is returned with one column. The name of the column is the name of the aggregation. For example:
2. Group the results by a field
This example takes the incoming result set and calculates the sum of the
bytes field and groups the sums by the values in the
... | stats sum(bytes) BY host
The results contain as many rows as there are distinct host values. There are two columns returned:
sum(bytes). If you don't specify a name for the results using the `AS <field> syntax, then the names of the columns are the name of the <by-clause> field and the name of the aggregation.
If there are two distinct hosts, the results are returned as a table similar to this:
3. Specifying multiple aggregations and multiple by-clause fields
You can also specify more than one aggregation and <by-clause> with the
stats command. You can rename the output fields using the AS <field> clause. For example:
...| stats sum(bytes) AS 'Sum of bytes', avg(bytes) AS Average BY host, sourcetype
This search organizes the incoming search results into groups based on the combination of
sourcetype. It returns the sum of the bytes in the
Sum of bytes field and the average bytes in the
Average field for each group. If there are two distinct hosts and two distinct sourcetypes, the search will produce results similar to this:
|Sum of bytes
4. Specifying a time span in the BY clause
This example counts the values in the action field and organized the results into 30 minute time spans.
When you use the
span argument, the field you use in the <by-clause> must be either the
_time field, or another field with values in UNIX time. For example:
...| stats count(action) AS count BY _time span=30m
stats command usage
streamstats command overview
This documentation applies to the following versions of Splunk® Cloud Services: current