Splunk online course

Splunk stats Command: Aggregate Event Data

Learn how to use Splunk stats to count events, calculate sums and averages, find minimums and maximums, and group results by fields.

The stats command summarizes matching Splunk events. Instead of returning each individual event, it calculates one or more aggregate values, such as an event count, a total, an average, a minimum, or a maximum.

Because stats is a transforming command, it changes event-level results into a report-like table. You can calculate one summary for all matching events or separate summaries for groups of events.

What the stats command does

A normal search can return many event records. Appending stats combines those records into calculated results. For example, this search returns one row containing the number of events produced by the base search:

<base search> | stats count

When a BY clause is included, Splunk creates one row for each unique grouping value:

<base search> | stats count BY date_wday

The output contains summary rows, not the original event fields. Keep the base search selective enough that it represents the events you want to measure.

Basic stats syntax

stats <aggregation>(<field>) [AS <output_field>] [BY <grouping_field>]

• Aggregation: A function such as count, sum, avg, min, or max.
• Field: The field whose values are used by the function. The general count form does not require a field.
• AS: An optional alias that gives the calculated column a readable name.
• BY: An optional grouping clause. It partitions events by each unique value and calculates the aggregate separately for each group.

For example:

<base search> | stats sum(bytes) AS total_bytes BY sourcetype

This produces one row per sourcetype, with a total_bytes value for each row.

Counting events

Count the complete result set

stats count counts the events returned by the search before the stats command:

<base search> | stats count

The result is normally a single row with a column named count. Use an alias when the result will be used in a report or dashboard:

<base search> | stats count AS event_count

Count events by a field

Use BY to count events separately for every unique value:

<base search> | stats count AS event_count BY date_wday

date_wday is a Splunk date/time-derived field representing the weekday associated with an event timestamp. A typical result might look like this:

Each row represents a group. The grouping column identifies the group, and the aggregate column reports the count for that group. A weekday is absent when no matching event has that weekday in the selected time range, or when the derived field is unavailable.

count versus count(field)

count counts every matching event. count(field) counts only events where the named field has a value:

<base search> | stats count AS all_events count(response_time) AS events_with_response_time

If some events do not contain response_time, events_with_response_time will be lower than all_events. This is useful for measuring field coverage, but use plain count when you need the total number of events.

Numeric aggregate functions

An aggregate function combines values from multiple events into one summary value. For numeric fields, the most common functions are:

You can calculate several measures in one command:

<base search> | stats count AS event_count sum(bytes) AS total_bytes avg(bytes) AS average_bytes min(bytes) AS smallest_bytes max(bytes) AS largest_bytes

For a measurement such as response time, max finds the largest recorded response-time value:

<base search> | stats max(response_time) AS maximum_response_time

Likewise, use min for the smallest recorded value:

<base search> | stats min(response_time) AS minimum_response_time

Missing field values are generally ignored by field-based numeric aggregates. If a field is missing from many events, the result describes only the events with usable values. Numeric calculations require values Splunk can interpret as numbers.

Group by one or more fields

A single grouping field creates one result row per distinct value:

<base search> | stats count AS event_count BY sourcetype

You can group by multiple fields to summarize combinations:

<base search> | stats count AS event_count BY date_wday, sourcetype

This creates a row for each weekday and sourcetype combination. Grouping by a field with many unique values, or by several fields, can produce a large result table. Use a focused base search, a lower-cardinality field, or sorting and limiting when appropriate.

Find groups with the highest or lowest event counts

There is an important difference between finding the largest field value and finding the group containing the most events:

• max(date_wday) evaluates the weekday values themselves. It does not identify the busiest weekday.
• To find the busiest weekday, first count events by weekday, then sort the resulting counts.

Sort grouped counts from highest to lowest:

<base search> | stats count AS event_count BY date_wday | sort - event_count

The first row has the largest count. To sort from lowest to highest:

<base search> | stats count AS event_count BY date_wday | sort event_count

The first row then has the smallest count. Inspect multiple rows when categories have equal counts: a tie means more than one group shares the same rank, so selecting only the first row can hide a valid result.

Weekday names may appear alphabetically, in aggregate-value order, or in another implementation-dependent order. Alphabetical order is not calendar order. If a report must display Monday through Sunday, apply an explicit ordering method, such as sorting by a numeric weekday-order field created or normalized for that report.

Interpreting results and handling data quality

• Missing groups: A group with no matching events does not normally appear in the output.
• Missing fields: count(field) excludes events without that field. sum, avg, min, and max cannot use missing values.
• Numeric values: Verify that fields such as bytes and response_time are extracted consistently and contain values Splunk can interpret numerically.
• Text that looks numeric: If values are stored or interpreted as strings, minimum and maximum comparisons can be lexical rather than numeric. For example, text ordering can place 100 before 20. Check field extraction and normalize or convert the values before calculating numeric aggregates when necessary.
• Time range: All statistics describe the events selected by the base search and its time picker. Changing the time range changes the totals.

stats, top, and sort

Use top when you need a quick frequency report:

<base search> | top sourcetype

Prefer stats when you need aliases, several aggregate functions, multiple grouping fields, or a custom workflow such as counting first and sorting afterward. See the Splunk top command and the Splunk sort command for related techniques.

Practical workflow

1. Choose the base search and time range that define the events to measure.
2. Decide whether you need one result for all events or one result per group.
3. Select the aggregate: count for event volume, or sum, avg, min, or max for numeric measurements.
4. Add an alias with AS if the default column name is unclear.
5. Add BY for grouped results.
6. Use sort after stats when ranking groups by their calculated values.
7. Check missing values, field types, ties, and the requested display order before interpreting the result.

Troubleshooting common stats results

The busiest weekday search returns the wrong result

Using max(date_wday) finds the greatest value of the weekday field, not the weekday with the most events. Use stats count BY date_wday, followed by sort - event_count.

min or max returns an unexpected value

The field may be text rather than numeric data. Verify the extraction, inspect representative events, and normalize or convert the field before applying numeric aggregates.

A weekday is missing

No matching event may exist for that weekday in the selected time range, or the timestamp-derived date_wday field may not be available. Check the time picker, timestamps, base search, and field extraction.

count(field) is lower than expected

This is expected when some events lack the named field. Use plain count for the total event count, or investigate why the field is missing.

Weekdays are not in calendar order

Sorting by the weekday name produces lexical order, and sorting by count produces frequency order. Use an explicit weekday sequence or a numeric ordering field when calendar order matters.

The grouped table is too large

The grouping field may have many unique values, or multiple fields may create many combinations. Narrow the base search, choose a more suitable grouping field, and sort or limit the summary for presentation.

Key exam notes

• stats is a transforming command that produces summary results.
• stats count counts all events returned by the preceding search.
• stats count(field) counts only events where that field has a value.
• BY field creates a separate aggregate row for each unique field value.
• Use stats count BY category | sort - count to find the category or categories with the most events.
• max(field) finds the largest field value; it does not find the group with the highest frequency.
• Use aliases such as AS event_count to make output easier to read.