Quick Answer

The answer is count, avg, and earliest. These are valid aggregation functions in the stats command because each operates on field values across a group of events to produce a single statistical result. Count tallies the number of events where a field exists, avg calculates the mean of a numeric field, and earliest returns the oldest timestamp for that field within each group. On the Splunk Core Certified User SPLK-1002 exam, this concept tests your ability to distinguish true aggregation functions from non-aggregating commands like eval or from functions that require specific syntax, such as values or list. A common trap is confusing earliest with first, but earliest is a valid stats function that works on timestamps, not event order. To remember, think of the three core statistical pillars: how many (count), what’s typical (avg), and when it started (earliest).