This page explains how to use the count aggregation function in APL.
count
aggregation in APL returns the total number of records in a dataset or the total number of records that match specific criteria. This function is useful when you need to quantify occurrences, such as counting log entries, user actions, or security events.
When to use count
:
Splunk SPL users
count
function works similarly to APL, but the syntax differs slightly.ANSI SQL users
count
function works similarly, but APL uses different syntax for querying.status | count |
---|---|
200 | 1500 |
404 | 200 |
sum
to calculate the total sum of a numeric field, as opposed to counting the number of records.avg
function calculates the average of a numeric field. Use it when you want to determine the mean value of data instead of the count.min
function returns the minimum value of a numeric field, helping to identify the smallest value in a dataset.max
function returns the maximum value of a numeric field, useful for identifying the largest value.countif
function allows you to count only records that meet specific conditions, giving you more flexibility in your count queries.