Used to compute multiple aggregate functions over the input.

It produces one row of data that contains both min and max results.

ParameterTypeRequiredDefault ValueDescription
function[a]Array of Aggregate Functionsoptional[b]count(as=_count) Specifies which aggregate functions to perform on each group.

[a] The argument name function can be omitted.

[b] Optional parameters use their default value unless explicitly set.

Hide omitted argument names for this function

Show omitted argument names for this function

The stats() is also available as a shorthand syntax by declaring an array of functions:

logscale
...
| stats(function=[min(), max()])

Is equivalent to:

logscale
...
| [min(),max()]

stats() Examples

The following query is equivalent to just count():

logscale
stats(function=count())

To find the maximum and minimum:

logscale
[min_response := min(responsetime), max_response := max(responsetime)]

The stats() can also be combined with the groupBy() function:

logscale
groupBy(
  ["RemoteAddressIP4", "Country", "Region", "City"], 
  function=stats(function=[
    collect(UserName, as=computersTargeted),
    count(aid, as=loginAttempts),
    count(aid, as=totalSystemsTargeted, distinct=true)
  ])
)

Or as it's syntax equivalent:

logscale
groupBy(
  ["RemoteAddressIP4", "Country", "Region", "City"], 
  function=[
    collect(UserName, as=computersTargeted),
    count(aid, as=loginAttempts),
    count(aid, as=totalSystemsTargeted, distinct=true)
  ]
)

This groups the content by the IP address and location, and then performs count() on those aggregated values for the number of login attempts and number of systems.