Splunk Search

stats vs eventstats

zacksoft
Contributor

I can't comprehend what 'eventstats' is. I went thru the splunk docs.
I wanna use math functions like avg.. etc.. not sure whether to use stats avg or eventstats avg !!
An example would be appreciated .

Thank you.

Labels (1)
Tags (1)
1 Solution

mayurr98
Super Champion

hey

stats - Calculates aggregate statistics over the results set, such as average, count, and sum. This is similar to SQL aggregation. If stats is used without a by clause only one row is returned, which is the aggregation over the entire incoming result set. If you use a by clause one row is returned for each distinct value specified in the by clause.
look this doc https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Stats

eventstats - Generate summary statistics of all existing fields in your search results and saves those statistics in to new fields. The eventstats command is similar to the stats command. The difference is that with the eventstats command aggregation results are added inline to each event and added only if the aggregation is pertinent to that event.
look this doc https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Eventstats

And here is a blog which will tell you the extact difference between them
https://www.splunk.com/blog/2014/04/01/search-command-stats-eventstats-and-streamstats-2.html

let me know if this helps !

View solution in original post

mayurr98
Super Champion

hey

stats - Calculates aggregate statistics over the results set, such as average, count, and sum. This is similar to SQL aggregation. If stats is used without a by clause only one row is returned, which is the aggregation over the entire incoming result set. If you use a by clause one row is returned for each distinct value specified in the by clause.
look this doc https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Stats

eventstats - Generate summary statistics of all existing fields in your search results and saves those statistics in to new fields. The eventstats command is similar to the stats command. The difference is that with the eventstats command aggregation results are added inline to each event and added only if the aggregation is pertinent to that event.
look this doc https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Eventstats

And here is a blog which will tell you the extact difference between them
https://www.splunk.com/blog/2014/04/01/search-command-stats-eventstats-and-streamstats-2.html

let me know if this helps !

vinitnitdgp
Engager

correctly said

0 Karma

493669
Super Champion

refer https://answers.splunk.com/answers/139534/what-are-the-calculated-differences-between-stats-and-even...
it will show difference between stats and eventstats with example
Hope this helps you.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...