Annotate Events With Aggregation - Example 1

Annotate events using stats() function and aggregation

Query

logscale
kvParse()
| stats([
avg(x),
table([x])
])

Introduction

The stats() function can be used to compute multiple aggregate functions over the input.

In this example, the stats() function is used with aggregation on the field x.

Example incoming data might look like this:

x=1
x=2
x=9
x=10

Step-by-Step

  1. Starting with the source repository events.

  2. logscale
    kvParse()

    Parses the string into key value pairs.

  3. logscale
    | stats([
avg(x),
table([x])
])

    Computes the aggregate functions avg() and table() over the field x, and returns the results in a field named _avg and a field named x. Note that the table() function returns more rows as output, whereas the avg() function only returns 1 row.

  4. Event Result set.

Summary and Results

The query is used to compute multiple aggregate functions over an input.

Sample output from the incoming example data:

_avgx
5.51
5.52
5.59
5.510