Splunk® Cloud Services

SPL2 Search Reference

fieldsummary command overview

The SPL2 fieldsummary command calculates summary statistics for one or more fields in your events. The summary information is displayed as a results table.


The required syntax is in bold.

[fields="["<wc-field-list>"]" ]

How the SPL2 fieldsummary command works

The SPL2 fieldsummary command calculates summary statistics, such as the count, maximum value, minimum value, mean, and standard deviation for the fields in your search results. These summary statistics are displayed in a table for each field in your results or for the fields you specify with the fieldsummary command.

For example, suppose you have the following visitor_log information:

hour visitor_count
0800 0
0900 212
1000 367
1100 489
1200 624
1300 609
1400 492
1500 513
1600 367
1700 337
1800 104

To return summary statistics for all of the fields in your search results, add the fieldsummary command to the end of your search:

FROM visitor_log | fieldsummary

The result looks similar to this:

field count distinct_
max mean min numeric_
stdev values
hour 11 11 0 1800 1300 800 11 331.6 [{"value":"1000","count":1},{"value":"1100","count":1},{"value":"1200","count":1},{"value":"1300","count":1},{"value":"1400","count":1},{"value":"1500","count":1},{"value":"1600","count":1},{"value":"1700","count":1},{"value":"1800","count":1},{"value":"800","count":1}]
11 10 1 624 374 0 11 201.1 [{"value":"367","count":2},{"value":"0","count":1},{"value":"104","count":1},{"value":"212","count":1},{"value":"337","count":1},{"value":"489","count":1},{"value":"492","count":1},{"value":"513","count":1},{"value":"609","count":1},{"value":"624","count":1}]

Insights into the summary fields

The fieldsummary command returns 10 fields with summary information.

Looking at the results shown in the previous example, notice a few things about these results:

values field
  • The entries in the values field are organized by count in descending order. You can see this clearly in the visitor_count row. The value "367" has a count of "2". All of the other values have a count of "1". Even though there are 11 values, only 10 are returned. This is because the default for the maxvals argument is 10.
  • When the entries in the values field have the same count, the entries are organized by value in lexicographical order. You can see this clearly in the hours row. The values that start with 1, such as "1000" come before values that start with 8 or 9, such as "800". The value "900" is not returned because only the first 10 values are returned by default. For more information, see Lexicographical order in the SPL2 Search Manual.
distinct_count field
  • This field shows the count of different values in a field in the search results. For the hours row, there are 10 different values for the hours in the day. For the visitor_count row, there are 9 different values for the number of visitors. The value "367" appears for both the 1000 hour and the 1600 hour.
is_exact field
  • This field specifies whether the count is an exact count or an approximate count of the distinct values in a field. The value "1" indicates that the count is exact. The value "0" indicates that the count is an approximate count. The maxvals argument controls whether the count is exact or approximate. In this search, the maxvals argument is not specified so the default value for the maxvals argument is used. The default value for the maxvals argument is 10.

For more information about the fields returned from the fieldsummary command, see fieldsummary command usage.

Optional arguments

There are two optional arguments that you can use with the fieldsummary command, maxvals and fields.

You can use the maxvals argument to specify how many distinct values you want returned from the search. If not specified, a maximum of 10 values is returned.

You can use the fields argument to specify which fields you want summary information for. If not specified, summary information is returned for all of the fields in your search results.

See also

fieldsummary command
fieldsummary command syntax details
fieldsummary command usage
fieldsummary command examples
Last modified on 31 January, 2024
fields command examples   fieldsummary command syntax details

This documentation applies to the following versions of Splunk® Cloud Services: current

Was this topic useful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters