Computes a value from all events and array elements of the specified array.

Function Traits: Aggregate

ParameterTypeRequiredDefaultDescription
array[a]stringrequired  A string in the format of a valid array followed by []. A valid array can either be an identifier, a valid array followed by . and an identifier, or a valid array followed by an array index surrounded by square brackets. For example, for events with fields incidents[0], incidents[1], ... this would be incidents[].
functionstringrequired  The function to be applied to each element.
varstringrequired  Array element field name to use in the function.

[a] The argument name array can be omitted.

The parameter name for array can be omitted; the following forms are equivalent:

logscale
array:reduceAll("value")

and:

logscale
array:reduceAll(array="value")

Syntactically, the function is similar to:

logscale
split(array)
| function(array)

but is more efficient.

The array:reduceAll() function applies to all the values across multiple events.

For example, with three events each containing an array a[] such that:

Event 1

logscale
a[0]=1, a[1]=4, a[2]=2

Event 2

logscale
a[0]=3, a[1]=5, a[2]=2

Event 3

logscale
a[0]=5, a[1]=2, a[2]=3

where the rows of a[] across all events are:

logscale
[1, 4, 2], [3, 5, 2], [5, 2, 3]

and the columns across all the events are

logscale
[1, 3, 5], [4, 5, 2], [2, 2, 3]

Running:

logscale
array:reduceAll("a[]", function=avg(x), var=x)

would result in the output:

logscale
_avg=3

since x would take the values of:

logscale
{1, 4, 2, 3, 5, 2, 5, 2, 3}

Compute the maximum value of all values in an array named values in all events:

logscale
array:reduceAll(values[], var=x, function=max(x))

Group by array values and the non-array field type

logscale
array:reduceAll(values[], var=x, function=groupby([type, x]))