stats

This search command creates an aggregate representation of data in the form of a table of statistics and a corresponding chart based on the field or fields specified. The command also supports the optional group by parameter, to apply aggregate functions on the distinct value of a specified field. For example, you can plot the aggregate count of data occurring from a particular host depending on the data-collector names.

The values displayed in the table of statistics and the bars displayed in the chart are clickable. When you click a value in the table, the tabular view is toggled to the search results view and events associated with those values are displayed.

This command is similar to the timechart command, except that it does not represent data on the basis of a specified time span; instead, it provides an aggregate representation.

stats (<aggregate-function>)+

stats (<aggregate-function> [as <alias>])+ 

stats (<aggregate-function>)+ [by <field>]

stats (<aggregate-function> [as <alias>])+ [by <field>]

In the preceding syntax, the following definitions apply:

• + indicates one or more similar expressions separated by a comma (,) or space.

• <aggregate-function> refers to the aggregate function used for creating the chart; for example, count, sum, or average.

  The following table describes the aggregate functions that can be used in the command syntax:

  Function	Syntax	Description
  Count	count (<field>)	Uses a field name as an argument and returns the number of occurrences of that field in the search results.
  Sum	sum (<field>)	Uses a field name as an argument and returns the sum of values of that field in the search results.
  Average	avg (<field>)	Uses a field name as an argument and returns the average of values of that field in the search results.
  where, <field> can be a field name or a tag name

• [as <alias>]) refers to the as parameter used for optionally renaming a field with an alternate field name (an alias).

• [by <field>] refers to a group by parameter that is optionally used in conjunction with the aggregate functions, to group the result set by the specified field.