Computes a value from all events and array elements of the specified array.

ParameterTypeRequiredDefault ValueDescription
array[a]stringrequired  A string in the format of a valid array followed by []. A valid array can either be an identifier, a valid array followed by . and an identifier, or a valid array followed by an array index surrounded by square brackets. For example, for events with fields incidents[0], incidents[1], ... this would be incidents[].
functionarray of aggregate functionsrequired  The function to be applied to each element. If several aggregators are listed for the function parameter, then their outputs are combined using the rules described for stats().
varstringrequired  Array element field name to use in the function.

[a] The parameter name array can be omitted.

Hide omitted argument names for this function

Show omitted argument names for this function

Syntactically, the function is similar to:

logscale Syntax
split(array)
| function(array)

but is more efficient.

The function applies to all the values across multiple events.

For example, with three events each containing an array a[] such that:

a[0]a[1]a[2]
142
352
523

Where the rows of a[] across all events are:

logscale Syntax
[1, 4, 2]
[3, 5, 2]
[5, 2, 3]

Running:

logscale
array:reduceAll("a[]", function=avg(x), var=x)

would result in the output:

logscale
_avg=3

since x would take the values of:

logscale Syntax
{1, 4, 2, 3, 5, 2, 5, 2, 3}

Click + next to an example below to get the full details.

Compute an Aggregated Value of an Array on All Events

Compute an aggregated value of a flat array on all events using the array:reduceAll() function

Query
logscale
array:reduceAll("values[]", var=x, function=max(x))
Introduction

The array:reduceAll() function computes a value across all events and array elements of the specified array. The reduce() method returns a single value: the function's accumulated result. In this example, the aggregate function max() is used to output a single event with a single field.

Step-by-Step

  1. Starting with the source repository events.

  2. logscale
    array:reduceAll("values[]", var=x, function=max(x))

    Computes the maximum value over all the values within the array values[] by using the max() on each element, and then across each event in the event set.

  3. Event Result set.

Summary and Results

The query is used to compute a value from all events and array elements of a specified array. The reduce() method is recommended, when you need to have a single value returned from iterating over your array. Only aggregate functions that return a single event with a single field (such as avg(), count(), sum(), max() etc.) are allowed as the function argument.