fieldsummary command syntax details

The required syntax is in bold.

fieldsummary

[maxvals=<unsigned_int>]

[fields="["<wc-field-list>"]" ]

Required arguments

fieldsummary

Syntax: fieldsummary

Description: Returns the distinct values for every field in your events, unless you specify fields that you want summary information for by using the fields arguments. By default, the fieldsummary command returns a maximum of 10 distinct values. Use the maxvals argument to specify a different maximum.

Optional arguments

maxvals

Syntax: maxvals=<unsigned_int>

Description: Specifies the maximum distinct values to return for each field. This can't be a negative number. If you set maxvals = 0, all available distinct values for each field are returned, which can impact search performance.

Default: 10

fields

Syntax: fields=[ <wc-field>, <wc-field> ...]

Description: A single field name or a comma-delimited list of field names. The field names must be enclosed in square brackets ( [ ] ). You can use the asterisk ( * ) as a wildcard to specify a list of fields with similar names. For example, if you want to specify all fields that start with "value", you can use a wildcard such as value*.

See also

fieldsummary command

fieldsummary command overview

fieldsummary command usage

fieldsummary command examples