Annotate Events With Aggregation - Example 1

Annotate events using stats() function and aggregation

Query

logscale
kvParse()
| stats([
avg(x),
table([x])
])

Introduction

The stats() function can be used to compute multiple aggregate functions over the input.

In this example, the stats() function is used with aggregation on the field x.

Example incoming data might look like this:

x=1
x=2
x=9
x=10

Step-by-Step

  1. Starting with the source repository events.

  2. flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0[\Add Field/] 1[\Add Field/] result{{Result Set}} repo --> 0 0 --> 1 1 --> result style 0 fill:#ff0000,stroke-width:4px,stroke:#000;
    logscale
    kvParse()

    Parses the string into key value pairs.

  3. flowchart LR; %%{init: {"flowchart": {"defaultRenderer": "elk"}} }%% repo{{Events}} 0[\Add Field/] 1[\Add Field/] result{{Result Set}} repo --> 0 0 --> 1 1 --> result style 1 fill:#ff0000,stroke-width:4px,stroke:#000;
    logscale
    | stats([
    avg(x),
    table([x])
    ])

    Computes the aggregate functions avg() and table() over the field x, and returns the results in a field named _avg and a field named x. Note that the table() function returns more rows as output, whereas the avg() function only returns 1 row.

  4. Event Result set.

Summary and Results

The query is used to compute multiple aggregate functions over an input.

Sample output from the incoming example data:

_avgx
5.51
5.52
5.59
5.510