eventstats - Splunk Documentation

DescriptionGenerates summary statistics from fields in your events and saves those statistics in a new field. Only those events that have fields pertinent to the aggregation are used in generating the summary statistics. The generated summary statistics can be used for calculations in subsequent commands in your search. See Usage.SyntaxThe required syntax is in bold.eventstats[allnum=] ...[]Required argumentsSyntax: ( | ) [AS ]Description: A statistical aggregation function. See Stats function options. The function can be applied to an eval expression, or to a field or set of fields. Use the AS clause to place the result into a new field with a name that you specify. You can use wild card characters in field names.Optional argumentsallnumSyntax: allnum=Description: If set to true, computes numerical statistics on each field, if and only if ,all of the values of that field are numerica...