This page explains how to use the make_list_if aggregation function in APL.
make_list_if
aggregation function in APL creates a list of values from a given field, conditioned on a Boolean expression. This function is useful when you need to gather values from a column that meet specific criteria into a single array. By using make_list_if
, you can aggregate data based on dynamic conditions, making it easier to perform detailed analysis.
This aggregation is ideal in scenarios where filtering at the aggregation level is required, such as gathering only the successful requests or collecting trace spans of a specific service in OpenTelemetry data. It’s particularly useful when analyzing logs, tracing information, or security events, where conditional aggregation is essential for understanding trends or identifying issues.
Splunk SPL users
eval
and stats
commands to create conditional lists. In APL, the make_list_if
function serves a similar purpose by allowing you to aggregate data into a list based on a condition.ANSI SQL users
CASE
statements combined with aggregation functions such as ARRAY_AGG
. In APL, make_list_if
directly applies a condition to the aggregation.expression
: The field or expression whose values will be included in the list.condition
: A Boolean condition that determines which values from expression
are included in the result.expression
that meet the specified condition
.
id | req_duration_ms_list |
---|---|
123 | [100, 150, 200] |
456 | [300, 350, 400] |
make_list
when you don’t need to filter the values based on a condition.countif
when you need a count of occurrences rather than a list of values.avgif
for numerical aggregations where you want a conditional average instead of a list.