Samples the event stream. Events that do not have the field being sampled are discarded.

ParameterTypeRequiredDefaultDescription
fieldstringoptional[a]@timestamp The names of the field to use for sampling events.
percentage[b]doubleoptional[a]1 Keep this percentage of the events.
  Maximum100 
  Valid Values1

[a] Optional parameters use their default value unless explicitly set

[b] The argument name percentage can be omitted.

Omitted Argument Names

The argument name for percentage can be omitted; the following forms of this function are equivalent:

logscale
sample("1")

and:

logscale
sample(percentage="1")

sample() Examples

Sample events keeping only 2% of the events

logscale
sample(percentage=2)

Sample events keeping only 0.1% of the events to allow groupby to find the most common hosts without hitting the groupby-limit:

logscale
sample(percentage=0.1)
| groupby(host)
| sort()