## Aggregate Query Functions

LogScale's aggregate query functions provide grouping and/or aggregation of event data.

Table: Aggregate Query Functions

FunctionDefault ArgumentAvailabilityDescription
`avg([as], field)``field` Calculates the average for a field of a set of events.
`bucket([buckets], [field], [function], [limit], [minSpan], [span], [timezone], [unit])``span` Extends the groupBy function for grouping by time.
`callFunction([as], field, function)``function` Calls the named function on a field over a set of events.
`collect(fields, [limit], [multival], [separator])``fields` Collects fields from multiple events into one event.
`count([as], [distinct], [field])``field` Counts given events.
`counterAsRate([as], field)``field` Calculates the rate for a counter field.
`groupBy(field, [function], [limit])``field` Groups events by specified fields and executes aggregate functions on each group.
`head([limit])``limit` Returns the oldest events.
`holtwinters([alpha], [beta], [gamma], period)``period`removed in 1.73Used to generate a trendline for a periodic dataset.
`linReg([prefix], x, y)``linreg` Computes linear relationship model between two variables using least-squares fitting.
`selectFromMax(field, include)`  Selects event with the largest value for the specified field.
`selectFromMin(field, include)`  Selects event with the smallest value for the specified field.
`selectLast(fields)``fields` Specify fields to select from events, keeping value of most recent event for each field.
`series(collect, [endmatch], [maxduration], [maxpause], [memlimit], [separator], [startmatch])``collect` Collects a series of values for selected fields from multiple events into one or more events.
`sort([field], [limit], [order], [reverse], [type])``field` Sorts events by their fields.
`sum([as], field)``field` Calculates the sum for a field over a set of events.
`top([as], [error], field, [limit], [max], [percent], [rest], [sum])``field` Finds the top results based on a given field.
`window([buckets], [function], [span])``function` Computes aggregate functions over a sliding window of data.

The following functions are supported only for testing queries and parsers.

Table: Aggregate (for testing) Query Functions

FunctionDefault ArgumentAvailabilityDescription
`createEvents([rawstring])`  Generates temporary events as part of the query.