Annotate Events With Aggregation - Example 1
Annotate events using stats()
function and aggregation
Query
kvParse()
| stats([
avg(x),
table([x])
])
Introduction
The stats()
function can be used to compute
multiple aggregate functions over the input.
In this example, the stats()
function is
used with aggregation on the field
x.
Example incoming data might look like this:
x=1 |
---|
x=2 |
x=9 |
x=10 |
Step-by-Step
Starting with the source repository events.
- flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0[\Add Field/] 1[\Add Field/] result{{Result Set}} repo --> 0 0 --> 1 1 --> result style 0 fill:#ff0000,stroke-width:4px,stroke:#000;logscale
kvParse()
Parses the string into key value pairs.
- flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0[\Add Field/] 1[\Add Field/] result{{Result Set}} repo --> 0 0 --> 1 1 --> result style 1 fill:#ff0000,stroke-width:4px,stroke:#000;logscale
| stats([ avg(x), table([x]) ])
Computes the aggregate functions
avg()
andtable()
over the field x, and returns the results in a field named _avg and a field named x. Note that thetable()
function returns more rows as output, whereas theavg()
function only returns 1 row. Event Result set.
Summary and Results
The query is used to compute multiple aggregate functions over an input.
Sample output from the incoming example data:
_avg | x |
---|---|
5.5 | 1 |
5.5 | 2 |
5.5 | 9 |
5.5 | 10 |