Skip to main content

values Grouping Operator

The values operator provides all the distinct values of a field. This allows you to quickly identify and understand all the values a field has in your data. Additionally, you have the option to group by other fields of interest.

Syntax

values(<field>) [by <group_by_fields>] [as <field_name>]

Response Field

The response field separates each value with a new line character and places them in lexicographical order as follows:

  • Numbers before letters
  • Numbers sorted in ascending based on the value of the first digit
  • Letters sorted in alphabetical order
  • Uppercase before lowercase letters

This is an example of a response field with IP addresses:

Screenshot of a list of IP addresses under the column header &#39;_values&#39; in Sumo Logic. The list includes IP addresses such as &#39;1.250.157.76,&#39; &#39;109.64.133.250,&#39; &#39;112.109.95.26,&#39; and several others.

Limitation

  • The first 100 distinct values are returned for a field.

Examples

Operational Analytics

To identify all IP addresses by region:

_sourceCategory=Labs/*
| parse regex "(?<ip_address>\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"
| values(ip_address) by region

To identify all IP addresses and namespaces by region:

_sourceCategory=Labs/*
| parse regex "(?<ip_address>\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"
| values(ip_address) as val_ip, values(namespace) as val_namespace by region

To identify all sources by error type in my stack that logged an error in the last 24 hours:

_sourceCategory=prod01*
| parse regex "(?i)(?<log_level>WARN|CRITICAL|ERROR|FATAL)"
| toUppercase(log_level)
| _sourceCategory as sc
| count as errors, values(sc) by log_level

To identify users that logged in from more than one country in the last 24 hours with a list of countries logged in from:

_sc=org-service “login”
| parse username
| geolookup country on ip=login_ip
| count_distinct(country), values(country) by username
| where count_distinct > 1

Security Analytics

To know if my services have interacted with any known IOC threats.

...| values(IOC) by src_ip

To understand what ports were scanned or communicated over by one src_ip.

_source="PatchingInfo" and _collector="AWS SecurityHub Non Prod"
| json field=_raw "port_name" as ports
| json field=_raw "src_ip" as src_ip
| values(ports) by ami
Status
Legal
Privacy Statement
Terms of Use

Copyright © 2024 by Sumo Logic, Inc.