Multivalue stats and chart functions
list(X)
Description
Returns a list of up to 100 values of the field X as a multivalue entry. The order of the values reflects the order of input events.
Usage
- If more than 100 values are in field X, only the first 100 are returned.
- This function processes field values as strings.
- You can use the
list(X)
function with thechart
,stats
, andtimechart
commands.
Basic examples
To illustrate what the list
function does, let's start by generating a few simple results. Use the makeresults
and streamstats
commands to generate a set of results that are simply timestamps and a count of the results which are used as row numbers. For example:
| makeresults count=1000 | streamstats count AS rowNumber
Add the stats
command with the list
function to return the numbers in ascending order.
| makeresults count=1000 | streamstats count AS rowNumber | stats list(rowNumber) AS numbers
The following image shows the results.
Compare these results with the results returned when the values
function is used.
values(X)
Description
Returns the list of all distinct values of the field X as a multivalue entry. The order of the values is lexicographical.
Usage
- By default there is no limit to the number of values returned. Users with the appropriate permissions can specify a limit in the
limits.conf
file. You specify the limit in the [stats | sistats] stanza using themaxvalues
setting. - This function processes field values as strings.
- You can use the
values(X)
function with thechart
,stats
, andtimechart
commands.
Basic examples
To illustrate what the values
function does, let's start by generating a few simple results. Use the makeresults
and streamstats
commands to generate a set of results that are simply timestamps and a count of the results which are used as row numbers. For example:
| makeresults count=1000 | streamstats count AS rowNumber
Add the stats
command with thevalues
function to return the numbers in lexicographical order.
| makeresults count=1000 | streamstats count AS rowNumber | stats values(rowNumber) AS numbers
Compare these results with the results returned when the list
function is used.
Event order functions | Time functions |
This documentation applies to the following versions of Splunk® Enterprise: 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13
Feedback submitted, thanks!