While top
is very convenient, stats
is extremely versatile. The basic structure of a stats
statement is:
stats functions by fields
Many of the functions available in stats
mimic similar functions in SQL or Excel, but there are many functions unique to Splunk too. The simplest stats
function is count
. Given the following query, the results will contain exactly one row, with a value for the field count:
sourcetype=tm1* error | stats count
Using the by
clause, stats
will produce one row per unique value for each field listed, which is similar to the behavior of top
. Run the following query:
sourcetype=tm1* error | stats count by date_month date_wday
It will produce a table like this:
There are a few things to note about these results:
- The results are sorted against the values of the by fields, in this case,
date_month
followed bydate_wday
. Unliketop
, the largest value will not necessarily be at the top of the list. You can sort in the GUI simply by clicking on the...