Splunk Search

What is the difference between stats eventstats streamstats?

maitrifer
Engager

Hi All I'm new to Splunk and I'm confused between stats eventstats and streamstats. Can anyone help me to understand?

Labels (1)
1 Solution

isoutamo
SplunkTrust
SplunkTrust
Hi
Here is one explanation https://splunkonbigdata.com/2018/09/29/difference-between-streamstats-and-eventstats-command-in-splu.... Shortly streamstats calculate over sliding window and eventstats over all values.
r. Ismo

View solution in original post

vikramyadav
Contributor

stats

Stats calculate aggregate statistics over the dataset, similar to SQL aggregation. If called without a by clause, one row is produced, which represents the aggregation over the entire incoming result set. 

eventstats

Eventstats calculates a statistical result same as stats command only difference is it does not create statistical results, it aggregates them to the original raw data.

streamstats

Streamstats command uses events before the current event to compute the aggregate statistics that are applied to each event.

 

-----------------------------------------------------

If this help your like will be appreciated 🙂

isoutamo
SplunkTrust
SplunkTrust
One addition to streamstats, you could define the window which it use to calculate stats. Also you could define some conditions dynamically for window. There are some cases where this is mandatory to get correct result. https://docs.splunk.com/Documentation/Splunk/8.0.5/SearchReference/Streamstats

isoutamo
SplunkTrust
SplunkTrust
Hi
Here is one explanation https://splunkonbigdata.com/2018/09/29/difference-between-streamstats-and-eventstats-command-in-splu.... Shortly streamstats calculate over sliding window and eventstats over all values.
r. Ismo

ITWhisperer
SplunkTrust
SplunkTrust

stats replaces the pipleline  - only calculated values based all the data in the pipeline are passed down the line

eventstats adds to the pipeline as a whole - calculated values are based on all the data in the pipeline and added as additional fields to the rows passed down the line

streamstats adds to the pipeline as it passes through - calculated values are based on the data received so far

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...