sample() Query Function

Samples the event stream. Events that do not have the field being sampled are discarded.

Parameters

Name

Type

Required

Default

Description

field

string

No

@timestamp

The names of the field to use for sampling events.

percentage

number

No

1

Keep this percentage of the events.

The implied parameter is percentage.

Examples

Sample events keeping only 2% of the events

humio
sample(percentage=2)

Sample events keeping only 0.1% of the events to allow groupby to find the most common hosts without hitting the groupby-limit:

humio
sample(percentage=0.1) | groupby(host) | sort()