An aggregate function combines multiple events into fewer events by grouping them according to one or more fields, or by applying mathematical operations across the grouped data. Aggregate functions reduce the number of events in the output compared to the input.

Common aggregate functions include groupBy() for grouping events by field values, count() for counting occurrences, sum() for totaling numeric values, and avg() for calculating averages.

Aggregate functions are typically used in queries where you need to summarize or analyze data patterns, such as counting error types, summing transaction values, or finding maximum/minimum values across time periods.

groupBy(statuscode, function=count(as=total))

avg(responsetime, as=avg_response)

max(bytes, as=max_bytes)

sum(amount, as=total_amount)

Functions using this Type: dropEvent(), eval(), fieldset()