Splunk Advanced Power User Practice Questions - Splunk Core Certified Advanced Power User (SPLK-1004) Exam

`eventstats` adds aggregated values to each event without removing the original events; `stats` returns only the aggregated table. `eventstats` runs only on accelerated data models; `stats` runs anywhere. `eventstats` is a streaming command; `stats` always runs at the indexer. `eventstats` requires a `BY` clause; `stats` does not.