Dennis Academy

Simple explanation

Building on the earlier introduction to stats, this lesson focuses specifically on more advanced, practical usage patterns you're likely to actually apply.

Technical explanation

Multiple grouping fields: stats count by host, sourcetype produces one row per unique COMBINATION of host and sourcetype, not a separate breakdown for each independently.
Combining multiple statistics with multiple groupings: stats count, avg(response_time) as avg_time, max(response_time) as max_time by host — a single command producing a rich, multi-metric summary table.
stats with eval-derived fields — a field calculated earlier via eval can be used within a later stats command just like any other field, letting you build custom calculated categories before aggregating them.
Common real-world pattern: ... | stats count by status | sort - count — a frequent combination for quickly seeing which status codes (or any categorical field) are most common, in descending order.
Performance consideration: stats is generally efficient, but grouping by a high-cardinality field (one with an enormous number of unique values, like a raw IP address across millions of events) can produce an unwieldy number of result rows and consume significant resources — worth being deliberate about what you group by.

Synonyms / related terms

| Term | Means | |---|---| | High cardinality | A field with a very large number of distinct values | | Multi-field grouping | Grouping stats results by more than one field simultaneously |

Concept Check

"A user runs stats count by host and stats count by sourcetype separately, expecting a combined breakdown by both dimensions together, only to realize each search only breaks down by its own single field." This is expected — to see counts broken down by the COMBINATION of both fields together, the correct approach is a single command: stats count by host, sourcetype, not two separate single-field stats commands.

Interview-style Q&A

Q: Why be cautious about grouping stats by a high-cardinality field like raw source IP address? A: "If a field has millions of unique values, grouping by it produces a result table with up to that many rows — often impractical to actually review, and expensive to compute and render. In practice, you'd often want to either further aggregate (like grouping by IP subnet instead of exact IP) or apply top/rare instead, which are specifically designed to surface a manageable, meaningful subset rather than every unique value."

Memory trick