Aggregation Operators :: Kloudfuse Docs

Aggregation Operators

Aggregation operators help aggregate log messages into groups.

FuseQL applies aggregations after applying the filters specified in the log search bar, and in the time range selected in the time picker. FuseQL groups all aggregations by time buckets, unless the user specifies additional grouping using the dropdown.

Kloudfuse automatically selects the count and count_unique operators by default, depending on the data type of the variable. For other operators, click the drop-down next to the (Show) label, and select the aggregation operator.

FuseQL supports these aggregator types:

Counting operators

count and count_unique

Statistical operators

min, max, avg, sum, stddev, stdvar, and percentiles

Ordered aggregation operators

first and last

Here is the comprehensive list of aggregation operators:

avg

Computes the average of numeric values.

count

Counts the total number of log lines.

count_unique

Counts only unique or distinct occurrences of the field.

This operator can be applied on fingerprints, labels or string valued facets (facet value can be of string/UUID/IP address datatype).

first

Computes the first of numeric values.

last

Computes the last of numeric values.

max

Computes the maximum of numeric values.

min

Computes the minimum of numeric values.

percentiles

Computes the percentiles (p50, p75, p90, p95 or p99) of numeric values.

stddev

Computes the standard deviation of numeric or duration-valued facets.

stdvar

Computes the standard variance of numeric or duration-valued facets.

sum

Computes the sum of numeric or duration-valued facets.