values()

Returns a deduplicated set of values returned by an expression as a sorted array.

Syntax

values(EXPR)

Parameters

EXPR: An expression that returns the values to collect.

Description

The values() function evaluates EXPR for each record and returns a sorted array of unique values with duplicates removed. Null values are ignored. It collects up to 100 unique values per group; values beyond 100 are discarded. You can change the maximum collection count using the system property araqne.logdb.values_capacity. The return type is array (array).

Use this function in aggregation commands such as stats and timechart.

Error codes

Code	Description
91020	The number of arguments is incorrect.

Usage examples

To prepare the WEB_APACHE_SAMPLE table used in these examples, refer to Preparing sample data.

Collect the list of HTTP methods used

table WEB_APACHE_SAMPLE | stats values(method)

Collect the list of unique URIs accessed per source IP address
```
table WEB_APACHE_SAMPLE | stats values(uri) by src_ip
```

Null value handling

json "[{'val': 'a'}, {'val': null}, {'val': 'b'}, {'val': 'a'}]"
| stats values(val)
| # values(val): ["a","b"]

Compatibility

The values() function has been available since before Logpresso Sonar 4.0.