Splunk® Enterprise

Search Manual

Download manual as PDF

Splunk Enterprise version 6.x is no longer supported as of October 23, 2019. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

Commands for advanced statistics

Now it is time to learn about of the rich set of commands that you can use to perform advanced statistics. The following tables organize these commands by the command category.

Commands that find anomalies

These commands are used to find anomalies in your data. Either search for uncommon or outlying events and fields or cluster similar events together.

Command Description
analyzefields Analyze numerical fields for their ability to predict another discrete field.
anomalies Computes an "unexpectedness" score for an event.
anomalousvalue Finds and summarizes irregular, or uncommon, search results.
cluster Clusters similar events together.
kmeans Performs k-means clustering on selected fields.
outlier Removes outlying numerical values.
rare Displays the least common values of a field.

Commands for predicting and trends

These commands predict future values and calculate trendlines that can be used to create visualizations.

Command Description
predict Enables you to use time series algorithms to predict future values of fields.
trendline Computes moving averages of fields.
x11 Enables you to determine the trend in your data by removing the seasonal pattern.

Commands for reports

These commands are used to build transforming searches. These commands return statistical data tables that are required for charts and other kinds of data visualizations.

Command Description
addtotals Computes the sum of all numeric fields for each result.
contingency Builds a contingency table, a co-occurrence matrix, for the values of two fields.
correlate Calculates the correlation between different fields.
eventstats Adds summary statistics to all search results.
outlier Removes outlying numerical values.
rare Displays the least common values of a field.
streamstats Adds summary statistics to all search results in a streaming manner.
timechart Create a time series chart and corresponding table of statistics. See also, Statistical and charting functions.
trendline Computes moving averages of fields.

See also

Related information
About advanced statistics
About advanced statistics
About anomaly detection

This documentation applies to the following versions of Splunk® Enterprise: 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.2.9, 6.2.10, 6.2.11, 6.2.12, 6.2.13, 6.2.14, 6.2.15

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters