values

The values aggregation function returns all of the distinct values of Expression across the group. This allows you to quickly identify and understand all the values a field has in your data.

Use this function with the summarize, eventstats, and timestats operators.

Syntax

​

    values( Expression [, Max [, ErrorRate] ] )

Arguments

​

• Expression: Expression used for aggregation calculation. Wildcards are not supported for field names.
• Max: An integer that limits the number of values returned. The default is 0 where all distinct values are returned.
• ErrorRate: Controls how accurately the function counts distinct values. Range is 0–1. The default value is 0.01. Higher values allow higher error rates (fewer unique values recognized), with the offsetting benefit of less memory usage.

Results

​

The response field separates each value with a new line character and places them in lexicographical order as follows:

• Numbers before letters
• Numbers sorted in ascending order based on the value of the first digit
• Letters sorted in alphabetical order
• Uppercase before lowercase letters

Examples

​

This example lists unique methods (HTTP verbs) on API requests, up to the limit

dataset="cribl_search_sample" dataSource=access*
| limit 1000 
| summarize values(request_method)