stats

This search command creates an aggregate representation of data in the form of a table of statistics and a corresponding chart based on the field or fields specified. The command also supports the optional group by parameter, to apply aggregate functions on the distinct value of a specified field. For example, you can plot the aggregate count of data occurring from a particular host depending on the data-collector names. Similarly, you can run other aggregate functions such as sum, avg, min, and max to find the sum, average, minimum (smallest), and maximum (highest) values of a field.

This command is similar to the timechart command, except that it does not represent data on the basis of a specified time span; instead, it provides an aggregate representation.

stats (<aggregate-function>)+

stats (<aggregate-function> [as <alias>])+ 

stats (<aggregate-function>)+ [by <field>]

stats (<aggregate-function> [as <alias>])+ [by <field>]

In the preceding syntax, the following definitions apply:

• + indicates one or more similar expressions separated by a comma (,) or space.

• <aggregate-function> refers to the aggregate function used for creating the chart; for example, count, sum, or average.

  The following table describes the aggregate functions that can be used in the command syntax:

  Function	Syntax	Description
  Count	count (<field>)	Uses field name as an argument and returns the number of occurrences of that field in the search results.
  Sum	sum (<field>)	Uses field name as an argument and returns the sum of values of that field in the search results.
  Average	avg (<field>)	Uses field name as an argument and returns the average of values of that field in the search results.
  Minimum	min (<field>)	Uses field name as an argument and returns the smallest value of that field.
  Maximum	max (<field>)	Uses field name as an argument and returns the highest value of that field.
  where, <field> can be a field name or a tag name

• [as <alias>]) refers to the as parameter used for optionally renaming a field with an alternate field name (an alias).
• [by <field>] refers to a group by parameter that is optionally used in conjunction with the aggregate functions, to group the result set by the specified field.