Search command - stats
The most common use of the stats command is to get a count of the total number of events that are the product of a search. To see how this works, run the following search query. Notice that the pipe that precedes the stats command filters the data that will be included in the final count:
SPL> index=main earliest=-30m latest=now | stats count
The preceding query will result in a single number that represents the total of all events within the given time modifier. Change the time modifier and the number should be reduced:
SPL> index=main earliest=-15m latest=now | stats count
You may be wondering where the count came from. The true format of a stats command is stats function(X). This asks the system to return the result of the function based on the field X. When the function count is used without parentheses, Splunk assumes that you are looking for the count of all events in the given search.
The stats command becomes a very powerful tool especially when you need...
