Clarification regarding search command and stats command

[Justin1224]

Hey everyone,

I'm confused about what the second command in my search does. Here is the whole search:

| useraccounts_tracker | search user_category=default | stats max(lastTime) as _time, values(user_category) as user_category, dc(dest) as dc(dest) by user | sort 100 - _time | fields _time,user,user_category,dc(dest)

Specifically what I'm unsure about:
-What does the search user_category=default command do?
-What does the stats max(lastTime) as _time, values(user_category) as user_category, dc(dest) as dc(dest) by user command do? I know when it says "as" it's renaming fields. So other than that, what is it doing?

Any help would be appreciated!

[somesoni2 · Accepted solution]

| `useraccounts_tracker` --->  generating/fetching data. Need to know the macro definition to know source of the data
| search user_category=default ---> From the fetched data, filtering result which satisfy the filter condition (value of user_category is default
| stats max(lastTime) as _time, values(user_category) as user_category, dc(dest) as dc(dest) by user ----> From the filtered results, generate statistics, group by field user, to get max of field lastTime and rename as field _time, list all uniue values of the field user_category as itself, get distinct count of field dest as field "dc(dest)".
| sort 100 - _time  ---> sort the results from stats command in descending order of field _time and select first 100 records
| fields _time,user,user_category,dc(dest) ---> selecting only the required fields and setting the order of the display.

[Justin1224]

That helps a lot, thank you!