Computes a value from all events and array elements of the specified array.

ParameterTypeRequiredDefault ValueDescription
array[a]stringrequired  A string in the format of a valid array followed by []. A valid array can either be an identifier, a valid array followed by . and an identifier, or a valid array followed by an array index surrounded by square brackets. For example, for events with fields incidents[0], incidents[1], ... this would be incidents[].
functionstringrequired  The function to be applied to each element.
varstringrequired  Array element field name to use in the function.

[a] The argument name array can be omitted.

Hide omitted argument names for this function

Show omitted argument names for this function

Syntactically, the function is similar to:

logscale
split(array)
| function(array)

but is more efficient.

The function applies to all the values across multiple events.

For example, with three events each containing an array a[] such that:

a[0]a[1]a[2]
142
352
523

Where the rows of a[] across all events are:

logscale
[1, 4, 2]
[3, 5, 2]
[5, 2, 3]

Running:

logscale
array:reduceAll("a[]", function=avg(x), var=x)

would result in the output:

logscale
_avg=3

since x would take the values of:

logscale
{1, 4, 2, 3, 5, 2, 5, 2, 3}

Compute an Aggregated Value of an Array on All Events

Compute an aggregated value of a flat array on all events using the array:reduceAll() function

Query
logscale
array:reduceAll(values[], var=x, function=max(x))
Introduction

The array:reduceAll() function computes a value across all events and array elements of the specified array. The reduce() method returns a single value: the function's accumulated result. In this example, the aggregate function max() is used to output a single event with a single field.

Step-by-Step

  1. Starting with the source repository events.

  2. logscale
    array:reduceAll(values[], var=x, function=max(x))

    Computes the maximum value over all the values within the array values[] by using the max() on each element, and then across each event in the event set.

  3. Event Result set.

Summary and Results

The query is used to compute a value from all events and array elements of a specified array. The reduce() method is recommended, when you need to have a single value returned from iterating over your array. Only aggregate functions that return a single event with a single field (such as avg(), count(), sum(), max() etc.) are allowed as the function argument.