array:reduceColumn()

`array:reduceColumn()`

Important

This function is considered experimental and under active development and should not be used in production.

The function must be enabled using the feature flag ArrayFunctions. See Enabling & Disabling Feature Flags.

Computes an aggregate value for each array element with the same index.

Parameter	Type	Required	Default	Description
`array`^[a]	string	required		The prefix of the array in LogScale, for example for events with fields `incidents[0], incidents[1], ...` this would be `incidents`.
`as`	string	optional^[b]	`_reduceColumn`	Name of the output array.
`function`	string	required		Aggregate function to use (for example `max()`).
`var`	string	required		Placeholder field name to use for array elements in the aggregate function.
^[a]The argument name `array` can be omitted. ^[b]Optional parameters use their default value unless explicitly set

Omitted Argument Names
The argument name for array can be omitted; the following forms of this function are equivalent:
logscale
array:reduceColumn("value[]")
and:
logscale
array:reduceColumn(array="value[]")

If, for example, all events contain arrays with the time taken for 3 different tasks, the query

logscale

array:reduceColumn(times, var=x,function=[avg(x), max(x)])

will compute the maximum and average time for each task.

If function is an aggregator that produces more than one event, such as groupBy(), the output of array:reduceColumn() will contain the same number of events as the maximum number of events produced in a column. The n'th event will contain an array with the values from the n'th event in all columns having an n'th event. This can lead to unreliable ordering of the output if the internal aggregate does not output ordered events (such as groupBy()).