mstats command: Overview, syntax, and usage

The SPL2 mstats command analyzes metric data by performing statistics on the measurement, metric_name, and dimension fields in metric indexes.

The SPL2 mstats command analyzes metric data by performing statistics on the measurement, metric_name, and dimension fields in metric indexes.

Note: The mstats command provides the best search performance when you use it to search a single or small number of metric_name values.

Syntax

The syntax for the SPL2 mstats command is different, but with similar capabilities, than the SPL version of the mstats command.

The required syntax is in bold.

| mstats

aggregates=[function-expression, ...]

predicate=(predicate-expression)

byfields=[field...]

Required parameters

aggregates

Syntax: aggregates=[function-expression, ...]

Description: One or more function expressions using the supported statistical functions. See Quick Reference for SPL2 Stats and Charting Functions. Separate multiple function expressions with commas. You must enclose the list of function expressions in square brackets [ ].

Optional parameters

predicate

Syntax: predicate=(predicate-expression...)

Description: One or more predicate expressions. Use logical operators, such as AND or OR, to separate multiple predicate expressions. See Predicate expressions in the SPL2 Search Manual. The predicate-expression must be enclosed in parentheses ( ).

Note: If no indexes are specified in the predicate, all of the indexes that you have access to in your module are searched.

Default: All of the indexes you have access to in your module.

byfields

Syntax: byfields=[field, ...]

Description: A comma-separated list of one or more field names to group the results by. You must enclose the field names in square brackets [ ]. You cannot use wildcards in the field names.

Default: None

Usage

You can use mstats in historical searches and real-time searches. When you use mstats in a real-time search with a time window, a historical search runs first to backfill the data.

In SPL2, metric names that contain one or more period ( . ) characters must be enclosed in single quotation marks.

This SPL2 command does not support the following arguments and options that are used with the SPL mstats command. Instead, the default values for these arguments and options are used:

  • append
  • backfill
  • chart
  • chart-options
  • chunk_size
  • fillnull_value
  • prestats
  • span-length. Use the SPL2 bin command as an alternative to the SPL span_length argument.
  • update_period

See also

mstats command

mstats command: Examples