The stats function options help the user in calculating the aggregation statistics with the results set, like the count, average, or sum. The syntax is given below: host = ”web application” | stats min(bytes) max(bytes) range(bytes) by status Stats function options We can also calculate the range by first calculating the max() and then min() and then subtracting both so that we get the desired range. Along with the range function, we make use of min() and max() for calculating the maximum and minimum of the ranges. The function that is used to find the range of several values is range(). Finding Range: This function is used for displaying the range of values of a field which is numeric type. The output depicts the variance and the mean of all the field values which are named bytes and all of them are organized by the HTTP events.ģ. The syntax is given below: host = ”web application” | stats mean(bytes) var(bytes) by status However, the functions that we use are mean() and var(). Both these functions are also calculated in a much similar way to the average in the above section. Finding mean and variance: We define mean as an average of all the given numbers whereas variance is the average of the difference squared from the value of the mean. The syntax is given below: host = ”web application” | stats avg(bytes) by statusĢ. Let us see the example below and try to find the average byte size of a file that is grouped by an HTTP code. However, if the user uses a BY clause, he will get more than one row that will depend on the grouping of the fields along with an additional field. If the user does not use the BY clause, he gives only one record showing the average number of the field containing all the events. Finding the average: a user can use the avg() function for finding the average of a numeric field the function takes up the name of the field as the input. A user can perform a lot of functions such as finding the average, grouping the results by a field, performing multiple aggregations, finding the range, finding mean and variance, etc.

A user can use more than one function by invoking the stats command, however, a user can make the use of BY clause only once.

This command only returns the field that is specified by the user, as an output. The Splunk stats command is a command that is used for calculating the summary of stats on the basis of the results derived from a search history or some events that have been retrieved from some index. Get ahead in your career by learning Splunk course through hkrtrainings Splunk Training ! About Splunk stats command It helps in contributing to the building of infrastructure and business related to the IT field. The user can also perform processes like indexing, capturing, and relating the machine-derived data by putting it in a container for the searching process which helps to produce alerts, graphs, visuals, and dashboards. It also helps to monitor, analyze and visualize the data generated from the machine data algorithms in real-time. The main requirement of Splunk is to extract insights from a huge amount of data. Splunk is a very well-known platform for the big data associated with its collections as well as for analytics.

Splunk stats list vs values