Splunk Search

What is the difference between stats command version 1 and version 2?

Marta88
Explorer

Hi,

I would like to know the difference between version 1 and version 2 of the stats command.

Thank you

Kind regards

Marta

Labels (1)
Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Marta88,

what do you mean with "stats command version 1 and version 2"?

stats command is more or less always the same.

Ciao.

Giuseppe

0 Karma

Marta88
Explorer

With the latest version of Splunk, I heard that there will be some changes, as reported on this link. But it is not specified which are the changes.

https://docs.splunk.com/Documentation/Splunk/9.1.1/ReleaseNotes/Deprecatedfeatures

 

Thanks

Marta

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Marta88,

as you can read at https://docs.splunk.com/Documentation/Splunk/latest/Admin/Limitsconf?utm_source=answers&utm_medium=i... the differences are:

use_stats_v2 = [fixed-width | <boolean>]
* Specifies whether to use the v2 stats processor.
* When set to 'fixed-width', the Splunk software uses the v2 stats processor
  for operations that do not require the allocation of extra memory for new
  events that match certain combinations of group-by keys in memory. Operations
  that cause the Splunk software to use v1 stats processing include the
  'eventstats' and 'streamstats' commands, usage of wildcards, and stats
  functions such as list(), values(), and dc().
* NOTE: Do not change this setting unless instructed to do so by Splunk Support.
* Default: true

and 

stats = <boolean>
* This setting determines whether the stats processor uses the required field
  optimization methods of Stats V2, or if it falls back to the older, less
  optimized version of required field optimization that was used prior to Stats
  v2.
* This setting only applies when 'use_stats_v2' is set to 'true' or
  'fixed-width' in 'limits.conf'
  * When Stats v2 is enabled and this setting is set to 'true', the stats
    processor uses the Stats v2 version of required field optimization.
  * When Stats v2 is enabled and this setting is set to 'false' the stats
    processor falls back to the older version of required field optimization.
* Do not change this setting unless instructed to do so by Splunk support.
* Default: false

In few words, the difference is that in V2 it isn't required allocation of extra memory used, this is maintained for eventats and streamstats.

Ciao.

Giuseppe

 

Get Updates on the Splunk Community!

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

You’ve probably heard the latest about AppDynamics joining the Splunk Observability portfolio, deepening our ...

Monitoring Amazon Elastic Kubernetes Service (EKS)

As we’ve seen, integrating Kubernetes environments with Splunk Observability Cloud is a quick and easy way to ...

Cloud Platform & Enterprise: Classic Dashboard Export Feature Deprecation

As of Splunk Cloud Platform 9.3.2408 and Splunk Enterprise 9.4, classic dashboard export features are now ...