here * denotes wildcard
stats values(*) as * will calculate all fields unique values
have a look at http://docs.splunk.com/Documentation/Splunk/7.0.3/SearchReference/Stats
stats - Calculates aggregate statistics over the results set, such as average, count, and sum. This is similar to SQL aggregation. If stats is used without a by clause only one row is returned, which is the aggregation over the entire incoming result set. If you use a by clause one row is returned for each distinct value specified in the by clause.
eventstats - Generate summary statistics of all existing fields in your search results and saves those statistics in to new fields. The eventstats command is similar to the stats command. The difference is that with the eventstats command aggregation results are added inline to each event and added only if the aggregation is pertinent to that event.
to better understand difference between stats and eventstats have a look at answer
https://answers.splunk.com/answers/139534/what-are-the-calculated-differences-between-stats-and-eventstats.html
... View more
