Why use eventstats and stats together?

[luna]

Hello,

I have seen eventstats and stats used together, but I’m not clear on why and when the use of the mentioned would need to be used.

can you explain why use eventstats and stats together and provide an example?

[tscroggins]

In a similar vein to @ITWhisperer's answer, I sometimes combine them for filtering, although this example is contrived:

| stats count by foo
| eventstats max(count) as mode
| where count==mode

[ITWhisperer]

eventstats adds fields to the events and preserves the existing fields

stats replaces the events with calculated fields

For example, let's say you wanted to chart percentage of events from each host per day

 ... | bin span=1d _time
| stats count BY _time host
| eventstats sum(count) as total by _time
| eval percent = count / total
| chart values(percent) by _time host

stats does the counting by time and host

eventstats calculates the daily total

eval calculates the daily percentage for each host