Multivalue stats and chart functions

list(X)

Description

Returns a list of up to 100 values of the field X as a multivalue entry. The order of the values reflects the order of input events.

Usage

• If more than 100 values are in field X, only the first 100 are returned.
• This function processes field values as strings.
• You can use the list(X) function with the chart, stats, and timechart commands.

Basic examples

To illustrate what the list function does, let's start by generating a few simple results. Use the makeresults and streamstats commands to generate a set of results that are simply timestamps and a count of the results which are used as row numbers. For example:

| makeresults count=1000 | streamstats count AS rowNumber

Add the stats command with the list function to return the numbers in ascending order.

| makeresults count=1000 | streamstats count AS rowNumber | stats list(rowNumber) AS numbers

The following image shows the results.

Compare these results with the results returned when the values function is used.

values(X)

Description

Returns the list of all distinct values of the field X as a multivalue entry. The order of the values is lexicographical.

Usage

• By default there is no limit to the number of values returned. Users with the appropriate permissions can specify a limit in the limits.conf file. You specify the limit in the [stats | sistats] stanza using the maxvalues setting.
• This function processes field values as strings.
• You can use the values(X) function with the chart, stats, and timechart commands.

Basic examples

To illustrate what the values function does, let's start by generating a few simple results. Use the makeresults and streamstats commands to generate a set of results that are simply timestamps and a count of the results which are used as row numbers. For example:

| makeresults count=1000 | streamstats count AS rowNumber

Add the stats command with thevalues function to return the numbers in lexicographical order.

| makeresults count=1000 | streamstats count AS rowNumber | stats values(rowNumber) AS numbers

]

Compare these results with the results returned when the list function is used.