Important

This function is considered experimental and under active development and should not be used in production.

The function must be enabled using the feature flag ArrayFunctions. See Enabling & Disabling Feature Flags.

Computes an aggregated value of an array on all events.

ParameterTypeRequiredDefault ValueDescription
array[a]stringrequired  The prefix of the array in LogScale, for example for events with fields incidents[0], incidents[1], ... this would be incidents.
asstringoptional[b]_reduceRow Name of the output array.
functionfunctionrequired  Aggregate function to use (for example max()). Must be an aggregate function that outputs a single event with a single field.
varstringrequired  Placeholder field name to use for array element to use in aggregate function.

[a] The argument name array can be omitted.

[b] Optional parameters use their default value unless explicitly set.

Hide omitted argument names for this function

Show omitted argument names for this function

Only aggregate functions that return a single event with a single field (such as avg(), count(), sum(), max() etc.) are allowed as the function argument.

The function cannot be join() or groupBy().

For instance, given an array of ages named ages on events:

Event 1: 

| fieldname   | value |
|-------------|-------|
| ages\[0\]   | 16    |
| ages\[1\]   | 32    |
| ages\[2\]   | 64    |

Event 2: 

| fieldname   | value |
|-------------|-------|
| ages\[0\]   | 15    |
| ages\[1\]   | 30    |
| ages\[2\]   | 45    |

Then using the aggregate function avg() as the function argument:

logscale
array:reduceRow(ages, var=x, function=avg(x))

Produces events 'Event 1' and 'Event 2' with the added field _reduceRow._avg as so:

Event 1: 

| fieldname            | value    |
|----------------------|----------|
| ages\[0\]            | 16       |
| ages\[1\]            | 32       |
| ages\[2\]            | 64       |
| _reduceRow._avg      | 37.333...|

Event 2: 

| fieldname            | value |
|----------------------|-------|
| ages\[0\]            | 15    |
| ages\[1\]            | 30    |
| ages\[2\]            | 45    |
| _reduceRow._avg      | 30    |