Overview of SPL2 stats and chart functions

Use statistical and charting functions to generate a calculation, such as an average or percentage, based on the fields in your events.

Using eval expressions in statistical and charting functions

In some of the examples for the statistical and charting functions you might see eval expressions.

Using an eval expression in a statistical or charting function is a shortcut for specifying an eval command that creates a field, followed by a stats command that references that field.

For example: 

... | stats count(eval(status="404")) AS count_status BY sourcetype

Here's another example: 

... | timechart eval(round(avg(cpu_seconds),2)) BY processor

Note: When you use an eval expression with the timechart command, you must also use BY clause.

As a shortcut, you can use an eval <expression> in a statistical or charting function where you would normally use a <field>. One example of the eval <expression> syntax is: 

... | stats func(eval(<expression>))

This eval <expression> syntax is equivalent to this command syntax: 

... | eval temp_field = <expression> | stats func(temp_field)

This eval <expression> syntax is equivalent to this command syntax: 

... | eval temp_field = <expression> | stats func(temp_field)

Using functions

  • All functions that accept strings can accept either a literal string or a field name. 
  • All functions that accept numbers can accept either literal numbers or any numeric field name.

Some field values are processed as string literals

Most of the statistical and charting functions expect the field values to be numbers. All of the values are processed as numbers, and any non-numeric values are ignored.

The following functions process the field values as string literal values, even though the values are numbers.

  • count
  • distinct_count
  • earliest
  • estdc
  • estdc_error
  • first
  • latest
  • last
  • list
  • max
  • min
  • mode
  • values

For example, you use the distinct_count function and the field contains values such as "1", "1.0", and "01". Each value is considered a distinct string value.

The only exceptions are the max and min functions. These functions process values as numbers if possible. For example, the values "1", "1.0", and "01" are processed as the same numeric value.