thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Foundational

stats Command

An SPL transforming command that calculates aggregate statistics such as count, sum, average and distinct count, grouped by fields.

Definition

stats returns a results table and supports functions including count, dc, sum, avg, min, max, values and list, with a by clause for grouping. Related commands include eventstats (adds results to events) and streamstats (cumulative). It is central to threat detection searches.

Example

index=proxy | stats dc(dest) as uniq_dest count by src_ip

Exam tip

stats discards raw events; eventstats keeps them. Know count vs dc (distinct count).

Related terms