Ok, so looking at the reference documentation, we are given: The differences between these commands are described in the following table: stats command eventstats command Events are transformed into a table of aggregated search results Aggregations are placed into a new field that is added to each of the events in your output You can only use the fields in your aggregated results in subsequent commands in the search You can use the fields in your events in subsequent commands in your search, because the events have not been transformed   REF: https://docs.splunk.com/Documentation/SplunkCloud/9.0.2305/SearchReference/Eventstats So, basically, the eventstats command doesn't change any of the events themselves, it just adds the field to the events pulled in from the query, where as stats is  direct calculation from the events. So all of the subsequent actions from stats will be based on the transformations done whereas the eventstats just added a new field with aggregate values? I'm finding that engaging with alot of this requires a new way of thinking, a so called Splunk and data analyst/engineering mindset that is constrained and molded by what is possible with SPL and Splunk Arch, especially when there are performance or resource constraints that might push an analyst or engineer to prefer or require a certain type of query over another.  ... View more