Feedback:

fieldsummary

Use the fieldsummary operator to generate a summary of the output fields from the AQL.

Syntax

|fieldsummary [maxvals=<integer>] [samplesize=<integer>] <fields>

maxvals=<integer>

Specify the maximum number of values to be included in the summary for each field. It must be a value between 2 and 100.

Default: 25
samplesize=<integer>

Specify the maximum number of rows to include in the summary. It must be a value between 1 and 100000000 (100 million rows).

The larger the sample size, the longer it will take.

Default: 1000000 (1 million rows).
<fields>

Specify the list of fields to be included in the summary. If it is not specified, the operator will generate the summary for all fields.

In the case of the eventlog table, by default, the operator generates the summary for the following fields: sourcetype, dcid, src, action, dest, url, and user.

The following fields are excluded for the eventlog table:

  • event_time

  • timestamp

  • message

  • original_event_time

  • volume

  • event_meta_id

  • _raw_id

  • day

  • hour

  • minute

Usage

You can use the fieldsummary operator to generate statistics of the resulting fields.

This operator works with both eventlog and ocsf schemas. For OCSF fields, use dotted notation to reference nested fields. For OCSF schema fields, array indexes start at array[1] and not array[0].

Examples include metadata.product.name and src_endpoint.ip.

Note: When querying OCSF data, fieldsummary generates results for each OCSF class separately. This helps differentiate statistics across different event types within your OCSF data.

The summary includes the following columns for each field:

  • field_name: Name of the field.

  • count: Number of values in the field.

  • distinct_count: Number of distinct values in the field if it is categorical (string or boolean) or it is src_port or dest_port.

  • max: Maximum value in the field if it is numeric.

  • min: Minimum value in the field if it is numeric.

  • mean: Mean value for the field if it is numeric.

  • values: List of the different values with their respective counts. It is an approximation of the most frequent values. This applies only for categorical fields (string or boolean) as well as src_port or dest_port.

Note: The AQL query must specify a lookup table before this piped operator. It can be any lookup table.

Examples

Example 1: Eventlog field summary

Copy 
example_lookup_table | where src_ip != '' and src_ip != 'null' | fields src_ip , event_size , action | fieldsummary src_ip, event_size, action

Example 2: OCSF field summary

Copy 
ocsf | fieldsummary maxvals=5 metadata.product.name, activity_name, src_endpoint.ip