Is your feature request related to a problem?
The eventstats command was added in #3585, but there remain important gaps compared with Splunk SPL’s eventstats, affecting feature parity.
What solution would you like?
What alternatives have you considered?
N/A
Do you have any additional context?
Execution plan & priorities summary:
- P0
- Close gaps in common aggregation functions (tracked separately)
- Support aggregation wildcard * (tracked under the stats enhancement issue) [TBD]
- P0.5
- Investigate the possibility of pushdown optimizations for SQL window function
- Add a memory limit guard for large inputs.
- P1:
- Deliver full parity for the
allnum parameter
- Add support for more aggregation functions
Is your feature request related to a problem?
The
eventstatscommand was added in #3585, but there remain important gaps compared with Splunk SPL’seventstats, affecting feature parity.What solution would you like?
What alternatives have you considered?
N/A
Do you have any additional context?
Execution plan & priorities summary:
allnumparameter