Computes the number of fields that this event uses internally for the values. Tags are not fields in most cases.
| Parameter | Type | Required | Default Value | Description |
|---|---|---|---|---|
as | string | optional[a] | _eventFieldCount | Name of output field. |
[a] Optional parameters use their default value unless explicitly set. | ||||
Note
The eventFieldCount() function must be used before any aggregate function, otherwise the field count will not be returned.
eventFieldCount() Examples
Click next to an example below to get the full details.
Search For Events by Number of Fields in Repository
Search for events with a certain number of fields in a repository using eventFieldCount() function
Query
eventFieldCount()| _eventFieldCount < 6Introduction
The eventFieldCount() function is used to
search for events depending on the number of fields on the event.
The eventFieldCount() function augments the
event data with the event field count information.
Step-by-Step
Starting with the source repository events.
- logscale
eventFieldCount()Determines the number of fields that events has, and returns the results in a field named _eventFieldCount.
- logscale
| _eventFieldCount < 6Searches for events that has fewer than 6 fields. Notice that you cannot do a direct comparison, as the function augments the event data with the event field count information, rather than returning data.
Event Result set.
Summary and Results
The query is used to get an overview of the event with a low field count.