Aggregate Query Functions

Humio's aggregate query functions take a set of events, parameters, or configurations; and produce, reduce, or modify values within that set, or within the events themselves within the query pipeline.

Table: Array Query Functions

FunctionImplied ArgumentAvailabilityDescription
avg([as], field)field Calculates the average for a field of a set of events.
bucket([buckets], [field], [function], [limit], [minSpan], [span], [timezone], [unit])span Extends the groupBy function for grouping by time.
callFunction([as], field, function)function Calls the named function on a field over a set of events.
collect(fields, [limit], [multival], [separator])fields Collects fields from multiple events into one event.
count([as], [distinct], [field])field Counts given events.
counterAsRate([as], field)field Calculates the rate for a counter field.
groupBy(field, [function], [limit])field Groups events by specified fields and executes aggregate functions on each group.
head([limit])limit Returns the oldest events.
holtwinters([alpha], [beta], [gamma], period)period Used to generate a trendline for a periodic dataset.
linReg([prefix], x, y)linreg Computes linear relationship model between two variables using least-squares fitting.
selectFromMax(field, include)  Selects event with the largest value for the specified field.
selectFromMin(field, include)  Selects event with the smallest value for the specified field.
selectLast(fields)fields Specify fields to select from events, keeping value of most recent event for each field.
series(collect, [endmatch], [maxduration], [maxpause], [memlimit], [separator], [startmatch])collect Collects a series of values for selected fields from multiple events into one or more events.
sort([field], [limit], [order], [reverse], [type])field Sorts events by their fields.
sum([as], field)field Calculates the sum for a field over a set of events.
top([as], [error], field, [limit], [max], [percent], [rest], [sum])field Finds the top results based on a given field.
window([buckets], [function], [span])function Computes aggregate functions over a sliding window of data.