6.3 The stats Command

Splunk Core Certified User Study Guide Exam

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

1.1 Current Exam Facts & Logistics 1.2 Study Strategy & Learning Path

2 Splunk Basics

2.1 Splunk Components 2.2 Uses of Splunk 2.3 Splunk Apps 2.4 User Settings & Basic Navigation

3 Basic Searching

3.1 Running Basic Searches 3.2 Setting Time Ranges 3.3 Contents of Search Results 3.4 Refining Searches 3.5 Using the Timeline 3.6 Working with Events 3.7 Controlling Search Jobs 3.8 Saving Search Results

4 Using Fields in Searches

4.1 Understanding Fields 4.2 Using Fields in Searches 4.3 The Fields Sidebar

5 Search Language Fundamentals

5.1 Basic Search Commands & Practices 5.2 The Search Pipeline 5.3 Specifying Indexes in Searches 5.4 table, rename, fields, dedup, and sort

6 Using Basic Transforming Commands

6.1 The top Command 6.2 The rare Command 6.3 The stats Command

7 Creating Reports and Dashboards

7.1 Saving and Editing Reports 7.2 Statistical Table Reports 7.3 Chart Visualization Reports 7.4 Creating Dashboards and Adding Reports 7.5 Editing Dashboards

8 Creating and Using Lookups

8.1 Lookup Concepts and File Examples 8.2 Creating Lookup Files and Definitions 8.3 Configuring Automatic Lookups 8.4 Using Lookups in Searches

9 Creating Scheduled Reports and Alerts

9.1 Scheduled Reports 9.2 Describing and Creating Alerts 9.3 Viewing Fired Alerts

6.3 The stats Command

Key Takeaways Explain This Topic AI

stats calculates aggregations over events and returns a Statistics table; without BY it returns one summary row.

User-level functions to know: count, distinct_count (dc), sum, avg, min, max, values, and list.

A BY clause creates one result row per distinct combination of the grouping fields.

top/rare are specialized frequency rankers with count/percent; stats is the general aggregation tool.

count() without a field counts events; distinct_count/dc counts unique field values.

Last updated: August 2026

6.3 The stats Command

Quick Answer: | stats <function>(field) [BY field] aggregates events into summary rows. Learn count , dc/distinct_count , sum , avg , min , max , values , and list , plus BY grouping. Use stats for general math; use top / rare when you specifically need most/least common value rankings with percents.

Topic 5.3 The stats command completes Domain 5.0 . If top / rare are specialized frequency tools, stats is the Swiss Army knife : count events, sum bytes, average durations, find min/max, list distinct values, and group those calculations with BY .

Why stats dominates real User work

After you can find events, you usually need answers , not pages of _raw :

How many errors per host?

What is average response time by URI?

How many distinct users hit an app today?

What is the max queue depth observed?

Those questions map cleanly to stats aggregations. Exam items often show four similar pipelines and ask which function matches the business ask.

Transforming behavior (same family)

stats is a transforming command :

• Consumes incoming events/results
• Emits aggregated rows on the Statistics tab
• With no BY clause , returns one row for the whole set
• With BY , returns one row per distinct group

• Pipeline Rows you should expect
• ... | stats count One row: total event count
• ... | stats count BY host One row per host
• ... | stats avg(bytes), max(bytes) BY status One row per status with two metrics
• Core syntax at User level ... | stats <agg> [AS <name>] [, <agg> ...] [BY <field-list>]
• Examples: index=web
• | stats count

• index=web
• | stats count BY status

• index=web
• | stats avg(bytes) AS avg_bytes, max(bytes) AS max_bytes BY host

AS renames output columns for readability—useful when multiple functions would otherwise produce long default names.

Aggregations you must recognize

Focus on the functions named in the User transforming-commands scope. You do not need every statistical function in the SPL reference for this exam domain.

Function Meaning Typical use

count or count(field) Event count, or count of events where field is present/non-null (field form) Volume: “how many?”

• distinct_count(field) / dc(field) Number of unique values of field Cardinality: “how many different users?”
• sum(field) Add numeric values Total bytes, total duration
• avg(field) Mean of numeric values Average latency
• min(field) / max(field) Smallest / largest value Extremes, peaks
• values(field) Unique values (sorted, deduplicated multivalue) “Which statuses appeared?”
• list(field) List of values (can include duplicates; order reflects encounter) Sample/sequence-style listings
• count vs distinct_count index=auth
• | stats count AS events, dc(user) AS unique_users
• count → how many auth events matched
• dc(user) → how many different usernames appeared

Exam trap: “How many users logged in?” is usually dc(user) , not raw count , unless the stem clearly means event volume.

values vs list

Both produce multivalue-style outputs useful for inspection:

• values — unique values (think “set”)
• list — values as encountered (can repeat)

If a question emphasizes unique members of a field across the set, prefer values or dc depending on whether they want the members or only the count of members.

• BY grouping patterns index=web
• | stats count, avg(bytes) BY host, status

Grouping fields appear as columns; metrics fill the rest. Each distinct (host, status) pair gets its own aggregation row.

• Goal SPL sketch
• Events per host stats count BY host
• Unique clients per status stats dc(clientip) BY status
• Total and average bytes per URI stats sum(bytes), avg(bytes) BY uri_path
• Min/max response time overall stats min(took), max(took)

Wildcards in BY field names are not how you “BY all hosts like web*”—you specify concrete field names. Filter earlier ( host=web* ) then BY host .

Contrast: stats vs top vs rare

Keep this comparison cold for the exam:

• Need Best fit Why
• Most common field values + percent top Built-in frequency ranking + percent
• Least common field values + percent rare Same, opposite rank direction
• Arbitrary aggregations / multiple metrics stats Flexible function list + BY
• “Top 10” as most frequent top limit=10 Prefer over reinventing with stats+sort for User answers

You can approximate frequencies with stats count BY field , then sort—but User exam answers for “most/least common with percent” usually point to top / rare . Use stats when the stem mentions sum/avg/min/max/distinct or multiple named metrics.

• Worked examples
• Total errors and unique failing hosts index=web status>=500
• | stats count AS errors, dc(host) AS failing_hosts
• Average and max bytes by status index=web
• | stats avg(bytes) AS avg_bytes, max(bytes) AS max_bytes BY status
• Which methods appeared (unique) index=web
• | stats values(method) AS methods_seen
• Busy hosts by event volume (stats style) index=web
• | stats count BY host
• | sort - count

That last pattern is valid, but if the question explicitly wants the top command’s percent column , | top host is the tighter answer.

Related reporting (not Domain 5 focus)

Commands such as chart and timechart also aggregate and are popular when building visualizations over categories or _time . For Domain 5.0 , stay centered on top , rare , and stats . Treat chart/timechart as “related later when creating chart reports,” not as substitutes you must master inside topic 5.3.

Common traps

count vs dc . Event volume ≠ unique values.

Forgetting BY yields one row. Surprise “single total” results usually mean you omitted grouping.

Using top for averages. Average bytes is stats avg(bytes) , never top .

Numeric functions on non-numeric fields. sum(status) is usually wrong; filter/convert appropriately in real life—exam stems pick sensible numeric fields ( bytes , durations).

Power User sprawl. Field aliases, data models, tstats , and CIM are outside Core User Domain 5—do not drag them into these answers.

• Quick selection checklist
• Stem says most/least common (+ percent)? → top / rare
• Stem says count/sum/avg/min/max/distinct/values/list? → stats
• Need split by category? → add BY
• Need several metrics at once? → comma-separate stats functions

Domain 5 rewards precise matching of intent → command → function . Memorize the eight functions in the table, the BY rule, and the top/rare contrast, and this 15% domain becomes high-confidence points.