Commands for advanced statistics

Now it is time to learn about the rich set of commands that you can use to perform advanced statistics. The following tables organize these commands by category.

Commands that find anomalies

These commands are used to find anomalies in your data. You can search for uncommon or outlying events and fields, or cluster similar events together.

Command Description
analyzefields Analyzes numeric fields for their ability to predict another discrete field.
anomalies Computes an "unexpectedness" score for an event.
anomalousvalue Finds and summarizes irregular, or uncommon, search results.
anomalydetection Computes a probability for each event and detects unusually small probabilities.
cluster Groups similar events together.
kmeans Partitions the events into k clusters, with each cluster defined by its mean value. Each event belongs to the cluster with the nearest mean value.
outlier Removes outlying numerical values.
rare Displays the least common values of a field.

Commands for predicting and trends

These commands predict future values and calculate trendlines that can be used to create visualizations.

Command Description
predict Predicts future values of a time series.
trendline Computes moving averages of fields.
x11 Looks for trends in a time series by removing repeating patterns.

Commands for reports, charts, and maps

These commands are used to build transforming searches. These commands return statistical data tables that are required for charts and other kinds of data visualizations.

Command Description
addtotals Computes the sum of all numeric fields for each search result.
contingency Builds a contingency table, a co-occurrence matrix, for the values of two fields.
correlate Calculates the correlation between different fields.
eval Calculates mathematical, string, or boolean expressions. Puts the value into a new field.
eventstats Adds summary statistics to all search results.
geostats Generates statistics to display geographic data and summarize the data on maps.
outlier Removes outlying numerical values.
rare Displays the least common values of a field.
stats Calculates aggregate statistics over the results set, such as average, count, and sum.
streamstats Adds summary statistics about the preceding events to each search result.
timechart Create a time series chart and corresponding table of statistics. See "Statistical and charting functions" in the Search Reference.
trendline Computes moving averages of fields.