Splunk® Enterprise

Search Reference

Download manual as PDF

Download topic as PDF

Multivalue stats and chart functions

list(X)

Description

Returns a list of up to 100 values of the field X as a multivalue entry. The order of the values reflects the order of input events.

Usage

  • If more than 100 values are in field X, only the first 100 are returned.
  • This function processes field values as strings.
  • You can use the list(X) function with the chart, stats, and timechart commands.

Basic example

To illustrate what the list function does, let's start by generating a few simple results.

  1. Use the makeresults and streamstats commands to generate a set of results that are simply timestamps and a count of the results which are used as row numbers.

    | makeresults count=1000 | streamstats count AS rowNumber

    The results appear on the Statistics tab and look something like this:

    _time rowNumber
    2018-04-02 20:27:11 1
    2018-04-02 20:27:11 2
    2018-04-02 20:27:11 3
    2018-04-02 20:27:11 4
    2018-04-02 20:27:11 5

    Notice that each result appears on a separate row.


  2. Add the stats command with the list function to the search. The numbers are returned in ascending order in a single, multivalue result.

    | makeresults count=1000 | streamstats count AS rowNumber | stats list(rowNumber) AS numbers

    The results appear on the Statistics tab and look something like this:

    numbers
    1
    2
    3
    4
    5

    Notice that it is a single result. There are no alternating row background colors.

  3. Compare this result with the results returned by the values function.


values(X)

Description

Returns the list of all distinct values of the field X as a multivalue entry. The order of the values is lexicographical.

Usage

  • By default there is no limit to the number of values returned. Users with the appropriate permissions can specify a limit in the limits.conf file. You specify the limit in the [stats | sistats] stanza using the maxvalues setting.
  • This function processes field values as strings.
  • You can use the values(X) function with the chart, stats, and timechart commands.

Lexicographical order sorts items based on the values used to encode the items in computer memory. In Splunk software, this is almost always UTF-8 encoding, which is a superset of ASCII.

  • Numbers are sorted before letters. Numbers are sorted based on the first digit. For example, the numbers 10, 9, 70, 100 are sorted lexicographically as 10, 100, 70, 9.
  • Uppercase letters are sorted before lowercase letters.
  • Symbols are not standard. Some symbols are sorted before numeric values. Other symbols are sorted before or after letters.

Basic example

To illustrate what the values function does, let's start by generating a few simple results.

  1. Use the makeresults and streamstats commands to generate a set of results that are simply timestamps and a count of the results, which are used as row numbers.

    | makeresults count=1000 | streamstats count AS rowNumber

    The results appear on the Statistics tab and look something like this:

    _time rowNumber
    2018-04-02 20:27:11 1
    2018-04-02 20:27:11 2
    2018-04-02 20:27:11 3
    2018-04-02 20:27:11 4
    2018-04-02 20:27:11 5

    Notice that each result appears on a separate row.

  2. Add the stats command with thevalues function the the search. The results are returned in lexicographical order.

    | makeresults count=1000 | streamstats count AS rowNumber | stats values(rowNumber) AS numbers

    The results appear on the Statistics tab and look something like this:

    numbers
    1
    10
    100
    1000
    101
    102
    103
    104
    105
    106
    107
    108
    109
    11
    110

    Notice that it is a single result. There are no alternating row background colors.

  3. Compare these results with the results returned by the list function.
    PREVIOUS
    Event order functions
      NEXT
    Time functions

    This documentation applies to the following versions of Splunk® Enterprise: 7.1.0, 7.1.1, 7.1.2


    Was this documentation topic helpful?

    Enter your email address, and someone from the documentation team will respond to you:

    Please provide your comments here. Ask a question or make a suggestion.

    You must be logged into splunk.com in order to post comments. Log in now.

    Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

    0 out of 1000 Characters