Samples the event stream. Events that do not have the field being sampled are discarded.
|string||optional||The names of the field to use for sampling events.|
|number||optional||Keep this percentage of the events.|
The parameter name for
percentage can be omitted; the following forms are equivalent:
Sample events keeping only 2% of the events
Sample events keeping only 0.1% of the events to allow groupby to find the most common hosts without hitting the groupby-limit:
sample(percentage=0.1) | groupby(host) | sort()