This page explains how to use the avgif aggregation function in APL.
avgif
aggregation function in APL allows you to calculate the average value of a field, but only for records that satisfy a given condition. This function is particularly useful when you need to perform a filtered aggregation, such as finding the average response time for requests that returned a specific status code or filtering by geographic regions. The avgif
function is highly valuable in scenarios like log analysis, performance monitoring, and anomaly detection, where focusing on subsets of data can provide more accurate insights.
Splunk SPL users
stats
function with conditional filtering. In APL, avgif
provides this filtering inline as part of the aggregation function, which can simplify your queries.ANSI SQL users
CASE
statement inside an AVG
function to achieve similar behavior. APL simplifies this with avgif
, allowing you to specify the condition directly.expr
: The field for which you want to calculate the average.predicate
: A boolean condition that filters which records are included in the calculation.grouping_field
: (Optional) A field by which you want to group the results.expr
field for the records that satisfy the predicate
. If no records match the condition, the result is null
.
geo.city | avg_req_duration_ms |
---|---|
New York | 325 |
London | 400 |
Tokyo | 275 |
req_duration_ms
) for HTTP requests that returned a status of 200 (status == "200"
), grouped by the city where the request originated (geo.city
).