VMware ESXi and vSphere Cluster Management

Splunk stats Command: Calculate Aggregate Statistics

Learn how to use Splunk's stats command to count events, calculate sums, averages, minimums, and maximums, group results, and find the highest- or lowest-count category.

The Splunk stats command calculates aggregate statistics from search results. It transforms matching events into a summarized table instead of returning the original event-by-event results.

An aggregate function combines values from multiple events into one summary value. Common aggregate functions include count, sum, avg, min, and max.

For example, a search that returns thousands of events can use stats to produce one total count, one row per weekday, or a table containing several numeric summaries. See the stats command reference lesson when you need to review the command pattern.

Basic stats Syntax

The general pattern is:

<base search> | stats <aggregate-function>(<field>) [AS <output-field>] [BY <grouping-field>]

The brackets indicate optional parts. You can provide one aggregate expression or several expressions in the same command. An alias is a custom output field name assigned with AS.

<base search> | stats count AS event_count sum(bytes) AS total_bytes BY date_wday

In this example, count and sum(bytes) are aggregate expressions, event_count and total_bytes are aliases, and date_wday is the grouping field.

Counting Events

Count all matching events

Use stats count to return the total number of events produced by the base search:

<base search> | stats count

This produces a single summarized row. The result is not a list of the matching events; it is a transformed result containing the total count.

Count events by weekday

date_wday is a Splunk time field representing the weekday associated with an event timestamp. Add it after BY to create a separate count for each weekday value:

<base search> | stats count by date_wday

The output contains one row for each distinct weekday value present in the results. The default count field is normally named count.

Use a readable count alias

Use AS to give the count a descriptive name:

<base search> | stats count AS event_count by date_wday

The alias makes later commands, saved searches, reports, and dashboards easier to understand. For example, you can sort using event_count instead of the generic name count.

Grouping Results with the BY Clause

The BY clause partitions events into groups based on one or more field values. stats produces one output row for each distinct value, or for each distinct combination when multiple grouping fields are used.

<base search> | stats count AS event_count by date_wday

If the search contains events from Monday, Tuesday, and Wednesday, the result has up to three rows—one for each weekday represented in the data. A weekday with no matching events does not receive a row.

To compare categories across two dimensions, list multiple fields after BY:

<base search> | stats count AS event_count by date_wday, sourcetype

This creates a group for every unique date_wday and sourcetype combination. For example, Monday events from one source type and Monday events from another source type are separate groups.

Common stats Aggregate Functions

sum and avg are intended for numeric fields. Confirm that the field exists and is extracted consistently as a number before using these functions. The behavior of min and max depends on the values and their type; they do not automatically mean “group with the most” or “group with the fewest.”

Calculate multiple summaries at once

One stats command can calculate several aggregates:

<base search> | stats count AS event_count sum(bytes) AS total_bytes avg(bytes) AS average_bytes min(bytes) AS smallest_bytes max(bytes) AS largest_bytes

Without aliases, Splunk commonly uses names such as count, sum(bytes), and avg(bytes). Aliases replace those expressions with names that are easier to reference.

Finding the Group with the Highest or Lowest Count

There is an important difference between finding the largest value in a field and finding the group containing the most events.

These searches inspect the values of date_wday itself:

<base search> | stats max(date_wday)
<base search> | stats min(date_wday)

They do not identify the weekday with the greatest or fewest event count. To find that category, first create grouped counts, then sort the summarized rows, and finally keep the first row.

Highest-count weekday

<base search> | stats count AS event_count by date_wday | sort - event_count | head 1

stats creates the weekday rows, sort - event_count orders them from largest to smallest count, and head 1 retains the first row.

Lowest-count weekday

<base search> | stats count AS event_count by date_wday | sort event_count | head 1

Without the minus sign, sort orders the aggregate rows in ascending order. head 1 then returns the lowest-count group.

Interpreting stats Output

A single stats result has no grouping field and generally returns one summary row. Adding BY changes the result into multiple rows when multiple groups exist.

stats is a transforming command: it converts event-level results into a summarized table. After it runs, the available fields are the aggregate output fields and fields explicitly listed in the BY clause. Other event fields are discarded.

Command Placement in a Search Pipeline

Filtering and field extraction should generally happen before aggregation. The base search and earlier commands determine which events and fields are available to stats.

<filtered and field-ready search> | stats count AS event_count by date_wday | sort - event_count | head 1

Commands after stats operate on summarized rows, not on the original events. Therefore, sort orders aggregate rows and head keeps aggregate rows. If a later command needs an event-level field that was not used in an aggregate or grouping clause, perform that operation before stats, or add the field to BY when appropriate.

Troubleshooting stats Searches

max(date_wday) does not find the busiest weekday

Cause: max evaluates the values stored in date_wday, not the number of events in each weekday group.

Resolution: Use stats count AS event_count by date_wday, then sort - event_count and head 1.

sum or avg returns an unexpected result

Cause: The field may be missing, nonnumeric, or inconsistently extracted.

Resolution: Verify that the field exists in the base search and contains usable numeric values before applying numeric aggregate functions.

The grouping field disappears

Cause: stats retains aggregate fields and fields listed after BY; other event-level fields are removed.

Resolution: Add the required field to the BY clause, or use it before the transforming command.

The highest-count group is not first

Cause: stats does not inherently order grouped output by aggregate value.

Resolution: Sort explicitly after aggregation, such as sort - event_count.

Weekdays appear alphabetically

Cause: Sorting text values is generally lexical, so weekday names may not appear in calendar order.

Resolution: Use a numeric weekday field for calendar ordering, or map weekday names to explicit numeric order values before sorting.