Splunk Search

What is the difference between stats command version 1 and version 2?

Marta88
Explorer

Hi,

I would like to know the difference between version 1 and version 2 of the stats command.

Thank you

Kind regards

Marta

Labels (1)
Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Marta88,

what do you mean with "stats command version 1 and version 2"?

stats command is more or less always the same.

Ciao.

Giuseppe

0 Karma

Marta88
Explorer

With the latest version of Splunk, I heard that there will be some changes, as reported on this link. But it is not specified which are the changes.

https://docs.splunk.com/Documentation/Splunk/9.1.1/ReleaseNotes/Deprecatedfeatures

 

Thanks

Marta

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Marta88,

as you can read at https://docs.splunk.com/Documentation/Splunk/latest/Admin/Limitsconf?utm_source=answers&utm_medium=i... the differences are:

use_stats_v2 = [fixed-width | <boolean>]
* Specifies whether to use the v2 stats processor.
* When set to 'fixed-width', the Splunk software uses the v2 stats processor
  for operations that do not require the allocation of extra memory for new
  events that match certain combinations of group-by keys in memory. Operations
  that cause the Splunk software to use v1 stats processing include the
  'eventstats' and 'streamstats' commands, usage of wildcards, and stats
  functions such as list(), values(), and dc().
* NOTE: Do not change this setting unless instructed to do so by Splunk Support.
* Default: true

and 

stats = <boolean>
* This setting determines whether the stats processor uses the required field
  optimization methods of Stats V2, or if it falls back to the older, less
  optimized version of required field optimization that was used prior to Stats
  v2.
* This setting only applies when 'use_stats_v2' is set to 'true' or
  'fixed-width' in 'limits.conf'
  * When Stats v2 is enabled and this setting is set to 'true', the stats
    processor uses the Stats v2 version of required field optimization.
  * When Stats v2 is enabled and this setting is set to 'false' the stats
    processor falls back to the older version of required field optimization.
* Do not change this setting unless instructed to do so by Splunk support.
* Default: false

In few words, the difference is that in V2 it isn't required allocation of extra memory used, this is maintained for eventats and streamstats.

Ciao.

Giuseppe

 

Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...