stats: count, values, dc, by

What is it?

`stats` collapses many events into a summary. `count` totals events, `dc(field)` counts distinct values, `values(field)` lists the distinct values, and `by field` groups the summary per entity (per user, per host).

Why it matters

Aggregation is how an anomaly appears: the account with 412 failures, the host talking to 300 distinct domains, the source hitting 50 different accounts. Raw events never show these; stats-by does.

Where you see it

`sourcetype=auth result=failure | stats count by user, src` — one row per user+src with a failure count. `... | stats dc(user) by src` — how many distinct accounts each source touched (spray detection).

What normal looks like

Normal aggregates are smooth: most users have a handful of failures, most sources touch one or two accounts. The distribution has no dramatic outlier.

What suspicious looks like

A single row far off the distribution: one src with dc(user)=50 (password spray), one user with count=400 (brute force), one host with dc(dest)=300 (beaconing or scanning).

How analysts investigate

Pick the metric that would reveal the technique (count for volume, dc for spread), group by the entity that would carry it, then sort to bring the outlier to the top.

Common beginner mistakes

Confusing count (rows) with dc (distinct values) — 400 failures against one account is not the same as failures against 400 accounts.
Forgetting the `by` clause, so you get one grand total instead of a per-entity breakdown.

Count volume, dc for spread

  sourcetype=auth result=failure | stats count by user, src | sort -count
    user       src             count
    a.hakim    203.0.113.44     412    ← brute force (volume on ONE account)
    b.nour     10.20.4.14         2

  sourcetype=auth result=failure | stats dc(user) as accounts by src | sort -accounts
    src             accounts
    203.0.113.44        50     ← password spray (ONE source, MANY accounts)

count reveals volume (brute force); dc reveals spread (spray). Choose the metric that matches the technique.

Quick check

To detect a password spray — one source trying many accounts — which stat do you group by src?

A quick self-check — it doesn't affect your XP or progress.