Consider the following data from a set of events in the orders dataset:

This search returns summaries for all fields in the orders dataset:

| FROM orders | fieldsummary

The following results are returned. The values for the mean and stdev fields are truncated, but look similar to this:

For a description of the summary information returned by the fieldsummary command, see fieldsummary command: Overview, syntax, and usage.

Consider the following data from a set of events in the orders dataset:

You can return summaries for all of the fields by including the fieldsummary command in your search without any other arguments. By default, a maximum of 10 values are returned for each field.

However, most of the time you want to specify which fields you want the summaries for. This search returns summaries for the specified fields in the orders dataset.

| FROM orders | fieldsummary fields=[action, pid, quantity]

Notice that the results are sorted by the field column in ascending order. In the values column, the values are sorted first by highest count and then by distinct value, in ascending order.

When you use wildcards to search for field names, you must enclose the field name in single quotation marks. For more information, see Quotation marks in the SPL2 Search Manual.

Consider the following data from a set of events in the hosts dataset:

This search returns summaries for fields in the hosts dataset with names that contain "kbps":

FROM hosts| fieldsummary fields=[host, '*kbps*']

By default, the fieldsummary command returns a maximum of 10 values. Use the maxvals argument to specify the number of values you want returned.

Consider the following data from a set of events in the hosts dataset:

This search returns summaries for fields in the hosts dataset with names that contain "kbps" and returns a maximum of 2 values:

FROM hosts| fieldsummary fields=[host, 'kbps*'] maxvals=2

The values are sorted first by highest count and then by distinct value, in ascending order. Compare this with the results returned in the example Using wildcards when specifying field names.

Consider the following data in the supply_orders dataset. The address field contains an object with key-value members:

Use the following search to return the supplier ID and the city names from the object in the address field:

| FROM supply_orders | fieldsummary fields=[supplier_ID, address.city]

The following results are returned. The values for the mean and stdev fields are truncated, but look similar to this: