Array of aggregate functions
An array containing multiple aggregate functions, allowing you to perform several aggregation operations simultaneously on the same dataset. This is more efficient than running multiple separate queries.
When using an array of aggregate functions, each function in the array operates independently on the data, producing its own result field. This is particularly useful when you need to calculate different metrics (such as count, sum, average, minimum, and maximum) over the same grouped data in a single pass.
For example, you might use [count(as=total), sum(bytes,
as=totalBytes), avg(responseTime, as=avgTime)] to simultaneously
count events, sum byte values, and calculate average response times in a
single aggregation operation.
groupBy(hostname, function=[count(as=events),
sum(bytes, as=total_bytes),
avg(responsetime, as=avg_time)])[min(temperature), max(temperature), avg(temperature)]
Functions using this Type:
accumulate(), array:reduceAll(), array:reduceColumn(), bucket(), dropEvent(), eval(), fieldset(), groupBy(), partition(), session(), slidingTimeWindow(), slidingWindow(), stats(), timeChart(), window()