1.

State difference between stats vs eventstats command.

Answer»
  • STATS: The Stats COMMAND in Splunk calculates statistics for EVERY field present in your events (search results) and STORES these values in newly created fields.
  • Eventstats: Similar to the stats command, this calculates a statistical RESULT. While the Eventstats command is similar to the Stats command, it adds the aggregate results inline to each event (if only the aggregate is relevant to that event).


Discussion

No Comment Found