Important
This function is considered experimental and under active development and should not be used in production.
The function must be enabled using the feature flag ArrayFunctions. See Enabling & Disabling Feature Flags.
Computes an aggregated value of an array on all events.
Parameter | Type | Required | Default Value | Description |
---|---|---|---|---|
array [a] | string | required | The prefix of the array in LogScale, for example, for events with fields incidents[0], incidents[1], ... this would be incidents . | |
as | string | optional[b] | _reduceRow | Name of the output array. |
function | function | required | Aggregate function to use (for example, max() ). Must be an aggregate function that outputs a single event with a single field. | |
var | string | required | Placeholder field name to use for array element to use in aggregate function. | |
[b] Optional parameters use their default value unless explicitly set. |
Only aggregate functions that return a single event with a single field
(such as avg()
, count()
,
sum()
, max()
etc.) are allowed
as the function
argument.
The function cannot be join()
or
groupBy()
.
array:reduceRow()
Examples
Click
next to an example below to get the full details.Calculate Average of Field Values in an Array
Calculate Average of Field Values in a flat array using the array:reduceRow()
function