Search command - stats
The most common use of the stats command is to get a count of the total number of events that are the product of a search. To see how this works, run the following search query. Notice that the pipe that precedes the stats command filters the data that will be included in the final count:
SPL> index=main earliest=-30m latest=now | stats count
The preceding query will result in a single number that represents the total of all events within the given time modifier. Change the time modifier and the number should be reduced:
SPL> index=main earliest=-15m latest=now | stats count
You may be wondering where the count came from. The true format of a stats command is stats function(X). This asks the system to return the result of ...
Get Splunk: Enterprise Operational Intelligence Delivered now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
