topic Clarification regarding search command and stats command in Splunk Search

Clarification regarding search command and stats command

Justin1224 — Tue, 29 Sep 2020 11:04:49 GMT

Hey everyone,

I'm confused about what the second command in my search does. Here is the whole search:

Specifically what I'm unsure about:
-What does the search user_category=default command do?
-What does the stats max(lastTime) as _time, values(user_category) as user_category, dc(dest) as dc(dest) by user command do? I know when it says "as" it's renaming fields. So other than that, what is it doing?

Any help would be appreciated!

Re: Clarification regarding search command and stats command

somesoni2 — Thu, 22 Sep 2016 19:33:06 GMT

| `useraccounts_tracker` --->  generating/fetching data. Need to know the macro definition to know source of the data
| search user_category=default ---> From the fetched data, filtering result which satisfy the filter condition (value of user_category is default
| stats max(lastTime) as _time, values(user_category) as user_category, dc(dest) as dc(dest) by user ----> From the filtered results, generate statistics, group by field user, to get max of field lastTime and rename as field _time, list all uniue values of the field user_category as itself, get distinct count of field dest as field "dc(dest)".
| sort 100 - _time  ---> sort the results from stats command in descending order of field _time and select first 100 records
| fields _time,user,user_category,dc(dest) ---> selecting only the required fields and setting the order of the display.

Re: Clarification regarding search command and stats command

Justin1224 — Fri, 23 Sep 2016 14:55:48 GMT

That helps a lot, thank you!