Counts the number of events in the repository, or streaming through the function. You can use this field name to pipe the results to other query functions or general use.

It's possible to specify a field and only events containing that field are counted. It's also possible to do a distinct count. When having many distinct values LogScale will not try to keep them all in memory. An estimate is then used, so the result will not be a precise match.

Function Summary
Signaturecount([as], [distinct], [field])
Output DataZero or One Event
Function TypeAggregate
IncompatibleFilter Alerts
Compatible ContextQuery, Live Query, Legacy Alert
Parameters for count()
ParameterTypeInterpreted TypeRequiredDefault ValueDescription
asstringfieldnameoptional[a] _count The name of the output field.
distinctbooleanbooleanoptional[a] false Defines whether to count incoming values, or count only the distinct (unique) values for a given field. If set to to true, the field to count must be specificed in the field parameter. For distinct values, estimates may be given for very large datasets.
    Values
    falseCounts non-distinct events or field values
    trueDetermine the distinct values for given field
field[b]stringfieldnameoptional[a]   The field for which only events are counted.

[a] Optional parameters use their default value unless explicitly set.

[b] The parameter name field can be omitted.

Hide omitted argument names for this function

Show omitted argument names for this function

Accuracy When Counting Distinct Values

When counting distinct values in a data stream, particularly when there are repeated elements in a limited memory environment, limitations exist in the accuracy of the count to avoid consuming too much memory in the process. For example, if counting 1,000,000 (million) events. If each event contains a different value, then memory is required to store the count for each of those million entries. Even if the field is only 10 bytes long, that is approximate 9MB of memory required to store the state. In LogScale, this affects the limits as outlined in State Sizes and Limits. As noted in that section, LogScale uses an estimation algorithm that produces an estimate of the number of distinct values while keeping the memory usage to a minimum.

While the algorithm in question doesn't give any guarantees on the relative error of the reported result, the typical accuracy (standard error) is less than 2%, with 2/3s of all results being within 1%, tests with up to 10^7 distinct values, the result at worst deviated by less than 0.02%. The worst results for each test can be seen in the table below:

Distinct ValuesResult of distinct countDeviation percentage
10100
1001000
1000995-0.005025125628
10000100390.003884849089
1000001009170.009086675189
1000000984780-0.01545522858
10000000101213020.01198482172

Important

For less than 100 distinct values, the deviation percentage will be exacerbated. For example, if there are only 10 distinct values, a deviation of 1 is 10%, even though it is the smallest possible deviation from the actual number of distinct values.

More typically, values used for aggregations or counts for distinct values will have low cardinality (for example, a small number of distinct values against the overall set).

count() Syntax Examples

Below are several examples using the count() function. Some are simple and others are more complex, with functions embedded within others.

Count All Events

This a simple example using the count() function. The query just counts the number of events found in the repository for the period of time selected:

logscale
count()

The result is just a single number, the total count.

_count
3886817

To format adding a thousands separator:

logscale
count()
| format("%,i", field=_count, as=_count)

Produces

_count 
3886,817
Group and Count

In this example, the query uses the count() function within the groupBy() function. The first parameter given is the field upon which to group the data. In this case, it's the HTTP method (for example, GET, PUT, POST). The second parameter says to use the function count() to count the number occurrences for each method found.

logscale
groupBy(field=method, function=count())

The result is a table with the column headings, method and _count, with the values for each:

method_count
DELETE7375
GET153493
POST31654
Chart of Daily Counts
count() Chart of Daily Counts

Figure 169. count() Chart of Daily Counts


You can use the count() function in conjunction with the timeChart() function to count the number occurrences of events or other factors. By default, the timeChart() function will aggregate the data by day. The results will look something like what you see in the screenshot shown in Figure 169, “count() Chart of Daily Counts”.

logscale
timeChart(function=count())
Table of Daily Counts

When a user accesses a web site, the event is logged with a status. For instance, the status code 200 is returned when the request is successful, and 404 when the page is not found. To get a list of status codes returned and a count of each for a given period, you would enter the following query in the Search box:

logscale
groupBy(field=status, function=count())

The sample output is shown below:

status_count
1019
20055258
204137834
3072
4002
4014
40357
404265
50462
stopping6
success6

count() Examples

Click + next to an example below to get the full details.

Aggregate Status Codes by count() Per Minute

Time-based event counting with default buckets using the bucket() function

Query
logscale
bucket(1min, field=status_code, function=count())
Introduction

Counts different HTTP status codes over time and buckets them into time intervals of 1 minute. Notice we group by two fields: status code and the implicit field _bucket.

Step-by-Step

  1. Starting with the source repository events.

  2. logscale
    bucket(1min, field=status_code, function=count())

    Sets the bucket interval to 1 minute, aggregating the count of the field status_code.

  3. Event Result set.

Summary and Results

Bucketing allows for data to be collected according to a time range. Using the right aggregation function to quantify the value groups that information into the buckets suitable for graphing for example with a Bar Chart, with the size of the bar using the declared function result, count() in this example.

Bucket Events Summarized by count()

Summarize events into buckets across selected timespan using the count() function

Query
logscale
bucket(function=count())
Introduction

Divides the search time interval into buckets. As time span is not specified, the search interval is divided into 127 buckets. Events in each bucket are counted:

Step-by-Step

  1. Starting with the source repository events.

  2. logscale
    bucket(function=count())

    Summarizes events using count() into buckets across the selected timespan.

  3. Event Result set.

Summary and Results

This query organizes data into buckets according to the count of events.

Count Total of Malware and Nonmalware Events

Count total of malware and nonmalware events in percentage

Query
logscale
[count(malware, as=_malware), count(nonmalware, as=_nonmalware)]
| total := _malware + _nonmalware
| nonmalware_pct_total := (_nonmalware/total)*100
| malware_pct_total := (_malware/total)*100
Introduction

It is possible to use the count() function to show the count in percentage of two fields against total. In this example, the function count() function is used to count the field malware and the field nonmalware and have the results returned in percentage. A result set could, for example, be normalware 30% and nonmalware 70%.

Step-by-Step

  1. Starting with the source repository events.

  2. logscale
    [count(malware, as=_malware), count(nonmalware, as=_nonmalware)]

    Returns the counted results of the field malware in a field named _malware and the counted results of the field nonmalware in a field named _nonmalware.

  3. logscale
    | total := _malware + _nonmalware

    Assigns the total of these events to a new field named total.

  4. logscale
    | nonmalware_pct_total := (_nonmalware/total)*100
| malware_pct_total := (_malware/total)*100

    Calculates the _malware and _nonmalware as a percentage of the total.

  5. Event Result set.

Summary and Results

The query is used to get an overview of the total number of malware versus nonmalware.

Get List of Status Codes

Get list of status codes returned and a count of each for a given period using the groupBy() function with count()

Query
logscale
groupBy(field=status, function=count())
Introduction

In this example, the groupBy() function is used to get a list of status codes for logged events. For instance, the status code 200 is returned when the request is successful, and 404 when the page is not found.

Step-by-Step

  1. Starting with the source repository events.

  2. logscale
    groupBy(field=status, function=count())

    Groups events by the status field, and counts the number of events in each group.

    It is possible to enhance the query for more detailed analysis. The following query example groups by both the fields status and source, limits to 1000 results, and sorts by count descending. groupBy([field=status, field=source], function=count(), limit=1000) | sort(_count, order=desc)

  3. Event Result set.

Summary and Results

The query is used to extract a list of status codes, each with a count of how many events have that status. The query is useful for summarizing and analyzing log data.

Sample output from the incoming example data:

status_count
10117
20046183
2043
3071
4002893
4014
Failure1
Success8633

Group HTTP Methods and Status Codes Using Nested groupBy()

Analyze HTTP traffic patterns by method and status code using the groupBy() function

Query
logscale
groupBy(method, function=[count(as=method_total), groupBy(statuscode, function=count(as=method_status_count))])
Introduction

In this example, the groupBy() function is used to analyze HTTP traffic patterns by grouping requests first by HTTP method and then by status code within each method.

Example incoming data might look like this:

@timestampmethodstatuscodepathbytes
2025-08-06T10:00:00ZGET200/index.html1024
2025-08-06T10:00:01ZPOST201/api/users512
2025-08-06T10:00:02ZGET404/missing.html256
2025-08-06T10:00:03ZGET200/about.html768
2025-08-06T10:00:04ZPOST400/api/users128
2025-08-06T10:00:05ZPUT200/api/users/1384
2025-08-06T10:00:06ZGET200/contact.html896
2025-08-06T10:00:07ZDELETE204/api/users/20
2025-08-06T10:00:08ZGET500/error.html1024
2025-08-06T10:00:09ZPOST201/api/orders756
Step-by-Step

  1. Starting with the source repository events.

  2. logscale
    groupBy(method, function=[count(as=method_total), groupBy(statuscode, function=count(as=method_status_count))])

    Groups events by the method field and performs two aggregations:

    • Counts total events for each HTTP method using count(), and returns the result in a new field named method_total.

    • Creates a nested grouping by statuscode within each method group, counting occurrences using count() and returns the result in a new field named method_status_count.

  3. Event Result set.

Summary and Results

The query is used to analyze HTTP traffic patterns by providing a hierarchical view of request methods and their associated status codes.

This query is useful, for example, to identify patterns in API usage, detect potential issues with specific HTTP methods, or monitor the distribution of success and error responses across different request types.

Sample output from the incoming example data:

methodmethod_totalstatuscodemethod_status_count
GET52003
GET54041
GET55001
POST32012
POST34001
PUT12001
DELETE12041

Note that the output shows the total count for each HTTP method in method_total and a breakdown of status codes and their counts within each method in method_status_count.

This data is well-suited for visualization using a Sankey diagram widget, which can effectively show the flow from HTTP methods to status codes.