Important

This function is considered experimental and under active development and should not be used in production.

The function must be enabled using the feature flag ArrayFunctions. See Enabling & Disabling Feature Flags.

Computes an aggregated value of an array on all events.

ParameterTypeRequiredDefault ValueDescription
array[a]stringrequired   The prefix of the array in LogScale, for example, for events with fields incidents[0], incidents[1], ... this would be incidents.
asstringoptional[b] _reduceRow Name of the output array.
functionfunctionrequired   Aggregate function to use (for example, max()). Must be an aggregate function that outputs a single event with a single field.
varstringrequired   Placeholder field name to use for array element to use in aggregate function.

[a] The parameter name array can be omitted.

[b] Optional parameters use their default value unless explicitly set.

Hide omitted argument names for this function

Show omitted argument names for this function

Only aggregate functions that return a single event with a single field (such as avg(), count(), sum(), max() etc.) are allowed as the function argument.

The function cannot be join() or groupBy().

Click + next to an example below to get the full details.

Calculate Average of Field Values in an Array

Calculate Average of Field Values in a flat array using the array:reduceRow() function