What kind of scenario we use eventstats vs stats?

[AL3Z]

Hi, Could you pls let me know in what scenario would we use eventstats vs stats?

[kiran_panchavat]

@AL3Z 

Stats:-

Calculates aggregate statistics over the entire dataset or subsets of the dataset.

Eventstats:-

Calculates summary statistics for all existing fields in the search results and adds these statistics as new fields to each event.

I hope this helps, if any reply helps you, you could add your upvote/karma points to that reply, thanks.

[richgalloway]

stats is a transforming command whereas eventstats is not.  IOW, the output of stats contains only the fields explicitly given in the command, but the output of eventstats contains all of the existing event fields *plus* those calculated by the command.

Use eventstats when you need to do a calculation across all events, while preserving the events themselves.  For example, to list the events where a field value exceeds the average.

...
| eventstats avg(x) as AvgX
| where x > AvgX
...

[ITWhisperer]

Eventstats can add new fields to existing events, (hence the name), whereas, using stats replaces existing events with stats events. So, scenarios where you want to keep the events, you might use eventstats, where you want to replace the events with the results of stats functions, you would use stats.