The following operators can be used in aggregate queries.
Given an expression, return
true if the expression is
all events in the stream.
select any(@Level = 'Error') from stream
Given a property name, computes the number of events that have a non-
null value for that property.
The special property name
* can be used to count all events.
select count(*) from stream where has(@Exception)
Given a property name or expression, computes the set of distinct values for that expression.
select distinct(ExceptionType) from stream where Application like 'Admissions%'
count() can be combined to count distinct values without returning them all.
select count(distinct(ExceptionType)) from stream
Given an expression, returns the value of that expression applied to the first or last events in the target range.
select first(Elapsed), last(Elapsed) from stream group by time(5m)
In a query that groups by time, the duration of each time slice.
select count(*) / (interval() / 1d) as per_day from stream group by time(30d)
Given a numeric expression or property name, computes the smallest or largest value for that expression.
select min(Elapsed / 1000) as ElapsedSeconds from stream group by time(1h)
Computes the arithmetic mean (average) of a numeric expression or property, i.e.
sum(expr) / count(expr).
select mean(ItemCount) from stream group by ItemId
Events where the expression is null or not numeric are ignored and do not contribute to the final result.
Given an expression and a percentage
p, calculates the value of the expression at or below which
p percent of the results fall.
select percentile(ResponseTime, 95) from stream group by time(1h), MachineName
This is the nearest rank percentile.
Given an expression or property name, calculates the sum of that value.
select sum(ItemsOrdered) from stream group by ItemId
Non-numeric results are ignored.
Updated 3 months ago