Aggregate Query Functions

LogScale's aggregate query functions provide grouping and/or aggregation of event data.

Table: Aggregate Query Functions

Function	Default Argument	Availability	Description
`avg([as], field)`	`field`		Calculates the average for a field of a set of events.
`bucket([buckets], [field], [function], [limit], [minSpan], [span], [timezone], [unit])`	`span`		Extends the groupBy function for grouping by time.
`callFunction([as], field, function)`	`function`		Calls the named function on a field over a set of events.
`collect(fields, [limit], [multival], [separator])`	`fields`		Collects fields from multiple events into one event.
`count([as], [distinct], [field])`	`field`		Counts given events.
`counterAsRate([as], field)`	`field`		Calculates the rate for a counter field.
`groupBy(field, [function], [limit])`	`field`		Groups events by specified fields and executes aggregate functions on each group.
`head([limit])`	`limit`		Returns the oldest events.
`holtwinters([alpha], [beta], [gamma], period)`	`period`	removed in 1.73	Used to generate a trendline for a periodic dataset.
`linReg([prefix], x, y)`	`linreg`		Computes linear relationship model between two variables using least-squares fitting.
`selectFromMax(field, include)`			Selects event with the largest value for the specified field.
`selectFromMin(field, include)`			Selects event with the smallest value for the specified field.
`selectLast(fields)`	`fields`		Specify fields to select from events, keeping value of most recent event for each field.
`series(collect, [endmatch], [maxduration], [maxpause], [memlimit], [separator], [startmatch])`	`collect`		Collects a series of values for selected fields from multiple events into one or more events.
`sort([field], [limit], [order], [reverse], [type])`	`field`		Sorts events by their fields.
`sum([as], field)`	`field`		Calculates the sum for a field over a set of events.
`top([as], [error], field, [limit], [max], [percent], [rest], [sum])`	`field`		Finds the top results based on a given field.
`window([buckets], [function], [span])`	`function`		Computes aggregate functions over a sliding window of data.