https://community.splunk.com/t5/Installation/What-is-the-difference-between-netstat-and-stats/m-p/645173#M12919 <P>The chief difference is <FONT face="courier new,courier">stats</FONT> aggregates results using statistical functions whereas <FONT face="courier new,courier">netstat</FONT> is not a Splunk command.&nbsp; Neither is associated with tables, although both can display output in a tabular fashion.</P><P>What problem are you trying to solve?</P> Wed, 31 May 2023 02:06:03 GMT richgalloway 2023-05-31T02:06:03Z https://community.splunk.com/t5/Installation/What-is-the-difference-between-netstat-and-stats/m-p/645165#M12918 <P>What is the main difference between a netstat command a stats commands as feel like one is associated with tables?</P> Wed, 31 May 2023 03:09:17 GMT https://community.splunk.com/t5/Installation/What-is-the-difference-between-netstat-and-stats/m-p/645165#M12918 keldridge1 2023-05-31T03:09:17Z https://community.splunk.com/t5/Installation/What-is-the-difference-between-netstat-and-stats/m-p/645173#M12919 <P>The chief difference is <FONT face="courier new,courier">stats</FONT> aggregates results using statistical functions whereas <FONT face="courier new,courier">netstat</FONT> is not a Splunk command.&nbsp; Neither is associated with tables, although both can display output in a tabular fashion.</P><P>What problem are you trying to solve?</P> Wed, 31 May 2023 02:06:03 GMT https://community.splunk.com/t5/Installation/What-is-the-difference-between-netstat-and-stats/m-p/645173#M12919 richgalloway 2023-05-31T02:06:03Z https://community.splunk.com/t5/Installation/What-is-the-difference-between-netstat-and-stats/m-p/645452#M12932 <P>What I am trying to solve is with botsv1 with the command index=botsv1 | stats count by http.http_method, http.hostname, http.url | sort -count in trying to identify malicious IP addresses.</P> Thu, 01 Jun 2023 22:17:36 GMT https://community.splunk.com/t5/Installation/What-is-the-difference-between-netstat-and-stats/m-p/645452#M12932 keldridge1 2023-06-01T22:17:36Z