stats

The stats command is used to calculate statistics over all events in a given search.

Syntax

The stats command is structured as follows:

• A list of aggregation functions, that may take a field name as an argument; and may have an alias specified with the as keyword to set the name of the resulting field.
  • There must always be at least one aggregation function.
• An optional by identifier, followed by at least one field name. All unique permutations of the values of these fields will result in a new aggregation group containing a copy of all specified aggregation functions.

| stats <aggregation>(<field>) as <output-name> by <field1>, <fieldN>

Aggregation Functions

List of available aggregation functions:

Takes a field name argument

• sum - Sums the numeric values in the given field.
• avg - Calculates the average numeric value of the given field.
• min - Finds the smallest value in the given field.
• max - Finds the largest value in the given field.
• unique - Counts the number of unique values in the given field.
• values - Returns a list of all unique values in the given field.

No field name argument

• count - Increments a counter for each aggregation group.

Example

Count how many events are associated with each systemd unit:

| select systemd
| stats count() by SYSTEMD_UNIT

will output rows with 2 columns, SYSTEMD_UNIT and count, containing the name of a systemd unit and the number of events associated with it respectively.

Get the number of events + the number of unique systemd units for each host:

| select systemd
| stats count() as event_count, unique(SYSTEMD_UNIT) as unique_units by HOSTNAME

will output rows with 3 columns, HOSTNAME, event_count, and unique_units.