Hi,
I would like to know the difference between version 1 and version 2 of the stats command.
Thank you
Kind regards
Marta
Hi @Marta88,
what do you mean with "stats command version 1 and version 2"?
stats command is more or less always the same.
Ciao.
Giuseppe
With the latest version of Splunk, I heard that there will be some changes, as reported on this link. But it is not specified which are the changes.
https://docs.splunk.com/Documentation/Splunk/9.1.1/ReleaseNotes/Deprecatedfeatures
Thanks
Marta
Hi @Marta88,
as you can read at https://docs.splunk.com/Documentation/Splunk/latest/Admin/Limitsconf?utm_source=answers&utm_medium=i... the differences are:
use_stats_v2 = [fixed-width | <boolean>]
* Specifies whether to use the v2 stats processor.
* When set to 'fixed-width', the Splunk software uses the v2 stats processor
for operations that do not require the allocation of extra memory for new
events that match certain combinations of group-by keys in memory. Operations
that cause the Splunk software to use v1 stats processing include the
'eventstats' and 'streamstats' commands, usage of wildcards, and stats
functions such as list(), values(), and dc().
* NOTE: Do not change this setting unless instructed to do so by Splunk Support.
* Default: true
and
stats = <boolean>
* This setting determines whether the stats processor uses the required field
optimization methods of Stats V2, or if it falls back to the older, less
optimized version of required field optimization that was used prior to Stats
v2.
* This setting only applies when 'use_stats_v2' is set to 'true' or
'fixed-width' in 'limits.conf'
* When Stats v2 is enabled and this setting is set to 'true', the stats
processor uses the Stats v2 version of required field optimization.
* When Stats v2 is enabled and this setting is set to 'false' the stats
processor falls back to the older version of required field optimization.
* Do not change this setting unless instructed to do so by Splunk support.
* Default: false
In few words, the difference is that in V2 it isn't required allocation of extra memory used, this is maintained for eventats and streamstats.
Ciao.
Giuseppe