field summary
Note
To see which AWS data source integrations support this PPL command, see Commands.
Use the fieldsummary command to calculate basic statistics for
each field (count, distinct count, min, max, avg, stddev, mean) and
determine the data type of each field. This command can be used with any
preceding pipe and will take them into account.
Syntax
Use the following syntax. For CloudWatch Logs use cases, only one field in a query is supported.
... | fieldsummary <field-list> (nulls=true/false)
includefields
-
List of all the columns to be collected with statistics into a unified result set.
Nulls
-
Optional.
-
If set to true, include null values in the aggregation calculations (replace null with zero for numeric values).
Example 1
PPL query:
os> source = t | where status_code != 200 | fieldsummary includefields= status_code nulls=true +------------------+-------------+------------+------------+------------+------------+------------+------------+----------------| | Fields | COUNT | COUNT_DISTINCT | MIN | MAX | AVG | MEAN | STDDEV | NUlls | TYPEOF | |------------------+-------------+------------+------------+------------+------------+------------+------------+----------------| | "status_code" | 2 | 2 | 301 | 403 | 352.0 | 352.0 | 72.12489168102785 | 0 | "int" | +------------------+-------------+------------+------------+------------+------------+------------+------------+----------------|
Example 2
PPL query:
os> source = t | fieldsummary includefields= id, status_code, request_path nulls=true +------------------+-------------+------------+------------+------------+------------+------------+------------+----------------| | Fields | COUNT | COUNT_DISTINCT | MIN | MAX | AVG | MEAN | STDDEV | NUlls | TYPEOF | |------------------+-------------+------------+------------+------------+------------+------------+------------+----------------| | "id" | 6 | 6 | 1 | 6 | 3.5 | 3.5 | 1.8708286933869707 | 0 | "int" | +------------------+-------------+------------+------------+------------+------------+------------+------------+----------------| | "status_code" | 4 | 3 | 200 | 403 | 184.0 | 184.0 | 161.16699413961905 | 2 | "int" | +------------------+-------------+------------+------------+------------+------------+------------+------------+----------------| | "request_path" | 2 | 2 | /about| /home | 0.0 | 0.0 | 0 | 2 |"string"| +------------------+-------------+------------+------------+------------+------------+------------+------------+----------------|
