What does the 'groupby_rank: "0" ' property in 'fields' member of job result response mean ?

[thepainfull]

Hello,

If I hit the url : services/search/jobs/[job id]/results in the API, I get a response like :

{
  "preview": false,
  "init_offset": 0,
  "messages": [],
  "fields": [
    {
      "name": "Field1",
      "groupby_rank": "0"
    },
    {
      "name": "Field2"
    }
  ],
  "results": [
    {
      "Field1": "some_value_1",
      "Field2": "some_value_2"
    },
    {
      "Field1": "some_value_3",
      "Field2": "some_value_4"
    },
    {
      "Field1": "some_value_5",
      "Field2": "some_value_6"
    }
  ],
  "highlighted": {}
}

In that response, what does the "groupby_rank: 0" property mean ? I couldn't find any explanation in the API doc (I can't post links) as it only details the GET parameters.

Thank you !

[jkat54 · Accepted solution]

This turns out to be the "by clause" if you're running a stats command with a by clause.

| timechart count is like a | stats count by _time and therefore the groupby_rank 0 would be equal to _time

I believe it would look like this:

<fieldOrder>
<field groupby_rank="0">_time</field>
<field groupby_rank="1">fieldname</field>
</fieldOrder>

If you did | stats count by _time fieldname. For example.

[thepainfull]

Ooooh ok I see, thank you !

[jkat54]

You're very welcome!