What Is The Difference Between Stats And Eventstats Commands?

1.	What Is The Difference Between Stats And Eventstats Commands?
Answer» Stats COMMAND generate SUMMARY STATISTICS of all existing fields in your search results and save them as values in new fields. Eventstats is similar to the stats command, except that aggregation results are added inline to each event and only if the aggregation is PERTINENT to that event. eventstats computes the requested statistics like stats, but aggregates them to the original raw DATA. Stats command generate summary statistics of all existing fields in your search results and save them as values in new fields. Eventstats is similar to the stats command, except that aggregation results are added inline to each event and only if the aggregation is pertinent to that event. eventstats computes the requested statistics like stats, but aggregates them to the original raw data.

Answer»

Stats COMMAND generate SUMMARY STATISTICS of all existing fields in your search results and save them as values in new fields. Eventstats is similar to the stats command, except that aggregation results are added inline to each event and only if the aggregation is PERTINENT to that event. eventstats computes the requested statistics like stats, but aggregates them to the original raw DATA.

Stats command generate summary statistics of all existing fields in your search results and save them as values in new fields. Eventstats is similar to the stats command, except that aggregation results are added inline to each event and only if the aggregation is pertinent to that event. eventstats computes the requested statistics like stats, but aggregates them to the original raw data.

Discussion

No Comment Found

Related InterviewSolutions

What Is Difference Between Splunk Sdk And Splunk Framework?
How Splunk Avoids Duplicate Indexing Of Logs ?
What Is Mapreduce Algorithm?
How Would You Handle/troubleshoot Splunk License Violation Warning Error?
If I Want Add/onboard Folder Access Logs From A Windows Machine To Splunk How Can I Add Same?
What Is Difference Between Search Head Pooling And Search Head Clustering?
What Is Dispatch Directory?
How Can I Tell When Splunk Is Finished Indexing A Log File?
How Do I Exclude Some Events From Being Indexed By Splunk?
What Is Fishbucket Or What Is Fishbucket Index?