If you have spent any real time writing searches in Splunk®, you already know the stats command shows up constantly. What a lot of intermediate users never pick up, though, is that two of its most common functions have shortcuts built right in.
Take a basic count. All four of these searches return the exact same result.
| stats c by src_ip
| stats c() by src_ip
| stats count by src_ip
| stats count() by src_ip| stats dc(src_ip) by host
| stats distinct_count(src_ip) by hostSplunk simply recognizes c as shorthand for count and dc as shorthand for distinct_count. Nothing about the underlying logic changes. The results are the same, the performance is the same, and the output field names behave the same way. The only thing that changes is how much you have to type to get there.
On its own, saving a few characters does not sound like much. But think about how often count and distinct_count actually show up. If you write searches every day, you are probably typing one or both of them dozens of times. Multiply that across weeks and months, and the abbreviated versions start to represent a meaningful chunk of typing you no longer have to do.
There is also a second benefit that is easy to overlook. Shorter syntax means less room for typos, and it means your searches read a little cleaner once you are used to them. Once dc and c are part of your muscle memory, you stop thinking about the syntax at all and start thinking purely about the question you are trying to answer, which is really the point of learning a search language in the first place.
None of this is a hidden trick in the sense that Splunk keeps it secret. It is documented behavior. But it is exactly the kind of detail that beginner tutorials tend to skip in favor of the fully spelled out versions, so plenty of people go months or years without ever running into it.
Small efficiencies like this rarely feel significant in the moment. A saved keystroke here or there does not change your day. But those saved keystrokes add up over the course of a career, the same way small habits tend to compound into something larger over time.
At Ableversity, we think knowing the platform well enough to work quickly is just as valuable as knowing what it can do in theory. Check out AbleU and see where you can start.
Web
App Store
Google Play
All trademarks, logos and brand names are the property of their respective owners. Use of these names does not imply endorsement.