In theory, they should give the same result, that is X number of rows with each row representing a KPI.
But what I have noticed is that 2/ gives the correct results, that is the correct number of rows for each kpi.
1/ on the other hand only gives a subset of them (e.g. 2/ would give 172 rows and 1/ would give <100 rows and this number would vary). And I am not sure why. I would have thought they would be the same.
This is an example of the event that comes up for the chosen time frame that the 2 searches are applied across:
So basically everything appears the same with the difference bein the search 1/ stats count(*) as * by host v 2/ stats count(kpi1) as kpi1 ... by host