Aggregate Functions
Introduction to Aggregate Functions
Aggregate function overview and categories
Aggregate functions combine multiple rows into a single summary value. They are used inside the summarize operator:
logs
| summarize
total = count(),
error_rate = countif(severity_number >= 17) * 1.0 / count(),
p95 = percentile(duration_ms, 95)
by service, bin(timestamp, 5m)Each aggregate collapses the rows in a group into one output row. The by clause defines the grouping keys. For a full introduction to writing queries, see Writing Queries.
Memory budget and sampling
summarize holds aggregate state in memory and merges it before producing results, so wide group-by keys, long time ranges, or heavy per-group state (percentiles, make_set/make_list, histograms) can grow it without bound. To stay safe under load, each summarize runs under a per-operator memory budget. When a query exceeds it, the engine degrades instead of failing or running the cluster out of memory: it keeps a representative subset of series — dropping whole series, never punching holes in a timechart — and returns a coverage warning telling you what fraction was retained. If there is no series axis to drop (for example grouping by bin(timestamp, …) alone), the query fails with an actionable error rather than a silently wrong result. Tune it per query with hint.budget=<size> and hint.sample={sample | heaviest}.
Statistical
| Function | Description |
|---|---|
| avg | Calculates the average of values in the group. |
| avgif | Calculates the average of values in the group for which the predicate evaluates to true. |
| binary_all_and | Returns the bitwise AND of every non-null value in the group, or null for a group without one. |
| binary_all_or | Returns the bitwise OR of every non-null value in the group, or null for a group without one. |
| binary_all_xor | Returns the bitwise XOR of every non-null value in the group, or null for a group without one. |
| count | Returns a count of the records in the input record set. |
| countif | Returns a count of the records for which a predicate is true. |
| covariance | Calculates the sample covariance of two numeric expressions, dividing the co-moment by n - 1. |
| covarianceif | Calculates the sample covariance of two numeric expressions over the rows for which the predicate is true. |
| covariancep | Calculates the population covariance of two numeric expressions, dividing the co-moment by n. |
| covariancepif | Calculates the population covariance of two numeric expressions over the rows for which the predicate is true. |
| dcount | Returns an estimate for the number of distinct values of the expression in the group. |
| dcountif | Returns an estimate for the number of distinct values of the expression in the group, for which the predicate evaluates to true. |
| max | Returns the maximum value across the group. |
| maxif | Returns the maximum value of the expression across the rows of the group for which the predicate is true. |
| min | Returns the minimum value across the group. |
| minif | Returns the minimum value of the expression across the rows of the group for which the predicate is true. |
| stdev | Calculates the sample standard deviation of values in the group. |
| stdevif | Calculates the sample standard deviation of values for which the predicate is true. |
| stdevp | Calculates the population standard deviation of values in the group. |
| sum | Calculates the sum of values in the group. |
| sumif | Calculates the sum of values in the group for which the predicate evaluates to true. |
| take_any | Returns an arbitrary non-null value from the group. |
| take_anyif | Returns an arbitrary non-null value from the group for which the predicate is true. |
| variance | Calculates the sample variance of values in the group. |
| varianceif | Calculates the sample variance of values for which the predicate is true. |
| variancep | Calculates the population variance of values in the group. |
| variancepif | Calculates the population variance of values for which the predicate is true. |
Arg
| Function | Description |
|---|---|
| arg_max | Returns both the maximum value and the corresponding return expression from the row where the first expression is maximum. |
| arg_min | Returns both the minimum value and the corresponding return expression from the row where the first expression is minimum. |
Make / Collect
| Function | Description |
|---|---|
| first | Returns the value of the expression from the row with the earliest timestamp. |
| last | Returns the value of the expression from the row with the latest timestamp. |
| make_bag | Returns a dynamic property bag holding every key of the property-bag values of expr in the group. |
| make_bag_if | Like make_bag, over the rows of the group for which predicate is true. |
| make_list | Returns a dynamic (JSON) array of all values of Expr in the group. |
| make_list_if | Returns a dynamic (JSON) array of values of expr for the rows in the group where predicate is true. |
| make_list_with_nulls | Returns a dynamic (JSON) array of all values of expr in the group, including nulls. |
| make_set | Returns a dynamic (JSON) array of all distinct values of Expr in the group. |
| make_set_if | Returns a dynamic (JSON) array of distinct values of expr for the rows in the group where predicate is true. |
| topk | Returns the K keys with the largest summed weight within each group, as a dynamic array of property bags ordered by weight descending. |
Dynamic / Graph
| Function | Description |
|---|---|
| make_graph | Folds parent-linked rows into a dynamic {nodes, edges} graph: one node per id and an edge parent_id -> id. |
| make_graph_by | Builds a collapsed {nodes, edges} graph directly from parent-linked rows: one node per distinct key value, and an edge for each row whose immediate parent carries a different key. |
| merge_graphs | Unions canonical {nodes, edges} graphs (produced by make_graph or summarize_graph) into one, aggregating same-id nodes and same-(from, to) edges. |
Percentile & Sketch
| Function | Description |
|---|---|
| hll | Creates a HyperLogLog sketch. |
| hll_if | Creates a HyperLogLog sketch for records where the predicate evaluates to true. |
| hll_merge | Merges multiple HyperLogLog sketches. |
| merge_tdigest | Merges multiple T-Digest sketches. |
| otel_histogram_merge | Merges OpenTelemetry histogram data points (explicit-boundary or exponential). |
| otel_histogram_percentile | Aggregate that merges OpenTelemetry histogram data points and extracts one or more percentiles from the merged result. |
| percentile | Calculates the specified percentile of a numeric column using DDSketch. |
| percentilew | Calculates a weighted percentile of a numeric column using DDSketch: each value counts as if it occurred weight times. |
| tdigest | Creates a T-Digest sketch from numeric values. |
Metrics
| Function | Description |
|---|---|
| deriv | Computes the derivative (rate of change) for a gauge metric. |
| otel_delta | Signed change of an OpenTelemetry metric over the group: last − first, with no reset correction. |
| otel_histogram_rate | Per-second rate of observation count for an OpenTelemetry histogram metric. |
| otel_increase | Total increase of an OpenTelemetry type=sum counter over the group, in the counter's own unit. |
| otel_rate | Computes the per-second rate from an OpenTelemetry type=sum metric. |
| otel_sample_interval | How far apart a single series' samples arrive, as a timespan — the emission interval for a pushed metric, the scrape interval for a scraped one (bzrk extension). |
| rate | Computes the per-second rate of change for a counter metric, handling counter resets. |
Other
| Function | Description |
|---|---|
| describe_schema | Infers JSON Schema from column values. |