stats command

The stats command calculates aggregate statistics over a dataset, such as average, count, and sum. In this section we will show how to use the stats command to get some useful info about your data.

To display the number of events on each day of the week, we can use the stats count by date_wday command, where date_wday is the name of the field that represents the days in the week:

stats count command example

To display the day of the week with the highest number of events, we can use the stats max(date_wday) command:

stats max command example

To display the day of the week with the lowest number of events, we can use the stats min(date_wday) command:

stats min command example

Splunk tutorial

Splunk tutorial

Geek University 2022