sourcetype'app' eventtype in (eventa,eventb,eventc) stats avg (timea) as 'Avg Response Time' BY MASA eval Avg Response Timeround Avg Response Time,2) Output I am getting from above search is two fields MASA and Avg Response Time. The error parameter value is important to making the count_distinct function return results quickly and in a scalable way.Īlso, note that when you want to count the distinct occurrences of more than one field, you must create an alias using the as operator to rename the _count_distinct fields. Splunk: Stats from multiple events and expecting one combined output. So for example, if the true count of distinct items is 1,000, the result returned by the approximation algorithm is between 9 about 95% of the time. stats count AS Purchases by City Using the stats command, we do a simple count to get the number of purchases by city.

99% of the time, results are within +/- 6%.

95% of the time, results are within +/- 4%.

65% of the time, results are within +/- 2%.

The basic structure of a stats statement is: stats functions by. For each ACCOUNT the number of IP accessed by it.

For each IP, the number of ACCOUNT it accesses. The approximation algorithm uses a relative error parameter of 2%, for example: Using stats to aggregate values While top is very convenient, stats is extremely versatile. Count unique values per field topdeck Explorer 05-25-2012 03:14 PM Hello, imagine you have two fields: IP, ACCOUNT An IP can access any number of ACCOUNT, an ACCOUNT can be accessed by any number of IP. If the number of distinct items returned is larger than 100, count_distinct instead uses an approximate algorithm, and displays a message that explains: count_distinct saw more than 100 values, results may be approximate When grouped by your Country field, youll have the number of distinct IPs from that given country. The dc () stats command means 'distinct count'. If the number of distinct items returned is less than 100, the count_distinct function provides an exact number. stats sparkline (count), dc (srcip) by Country. To order your results, use the sort operator.

By default, ordering is not defined inside of groups created using a group-by expression.

Splunk stats unique