Multivalue stats and chart functions
list(<value>)
Description
The list
function returns a multivalue entry from the values in a field. The order of the values reflects the order of the events.
Usage
You can use this function with the chart, stats, and timechart commands.
- If more than 100 values are in a field, only the first 100 are returned.
- This function processes field values as strings.
Basic example
To illustrate what the list
function does, let's start by generating a few simple results.
- Use the
makeresults
andstreamstats
commands to generate a set of results that are simply timestamps and a count of the results which are used as row numbers.| makeresults count=1000 | streamstats count AS rowNumber
The results appear on the Statistics tab and look something like this:
_time rowNumber 2018-04-02 20:27:11 1 2018-04-02 20:27:11 2 2018-04-02 20:27:11 3 2018-04-02 20:27:11 4 2018-04-02 20:27:11 5 Notice that each result appears on a separate row.
- Add the
stats
command with thelist
function to the search. The numbers are returned in ascending order in a single, multivalue result.| makeresults count=1000 | streamstats count AS rowNumber | stats list(rowNumber) AS numbers
The results appear on the Statistics tab and look something like this:
numbers 1
2
3
4
5Notice that it is a single result. There are no alternating row background colors.
- Compare this result with the results returned by the
values
function.
values(<values>)
Description
The values
function returns a list of the distinct values in a field as a multivalue entry. The order of the values is lexicographical.
Usage
You can use the values(X)
function with the chart, stats, timechart, and tstats commands.
- By default there is no limit to the number of values returned. Users with the appropriate permissions can specify a limit in the
limits.conf
file. You specify the limit in the [stats | sistats] stanza using themaxvalues
setting. - This function processes field values as strings.
Lexicographical order
Lexicographical order sorts items based on the values used to encode the items in computer memory. In Splunk software, this is almost always UTF-8 encoding, which is a superset of ASCII.
- Numbers are sorted before letters. Numbers are sorted based on the first digit. For example, the numbers 10, 9, 70, 100 are sorted lexicographically as 10, 100, 70, 9.
- Uppercase letters are sorted before lowercase letters.
- Symbols are not standard. Some symbols are sorted before numeric values. Other symbols are sorted before or after letters.
Basic example
To illustrate what the values
function does, let's start by generating a few simple results.
- Use the
makeresults
andstreamstats
commands to generate a set of results that are simply timestamps and a count of the results, which are used as row numbers.| makeresults count=1000 | streamstats count AS rowNumber
The results appear on the Statistics tab and look something like this:
_time rowNumber 2018-04-02 20:27:11 1 2018-04-02 20:27:11 2 2018-04-02 20:27:11 3 2018-04-02 20:27:11 4 2018-04-02 20:27:11 5 Notice that each result appears on a separate row.
- Add the
stats
command with thevalues
function to the search. The results are returned in lexicographical order.| makeresults count=1000 | streamstats count AS rowNumber | stats values(rowNumber) AS numbers
The results appear on the Statistics tab and look something like this:
numbers 1
10
100
1000
101
102
103
104
105
106
107
108
109
11
110Notice that it is a single result. There are no alternating row background colors.
- Compare these results with the results returned by the
list
function.
Event order functions | Time functions |
This documentation applies to the following versions of Splunk Cloud Platform™: 9.2.2406, 8.2.2201, 8.2.2203, 8.2.2112, 8.2.2202, 9.0.2205, 9.0.2208, 9.0.2209, 9.0.2303, 9.0.2305, 9.1.2308, 9.1.2312, 9.2.2403 (latest FedRAMP release)
Feedback submitted, thanks!