This page explains how to use the make_set aggregation function in APL.
make_set
aggregation in APL (Axiom Processing Language) is used to collect unique values from a specific column into an array. It is useful when you want to reduce your data by grouping it and then retrieving all unique values for each group. This aggregation is valuable for tasks such as grouping logs, traces, or events by a common attribute and retrieving the unique values of a specific field for further analysis.
You can use make_set
when you need to collect non-repeating values across rows within a group, such as finding all the unique HTTP methods in web server logs or unique trace IDs in telemetry data.
Splunk SPL users
values
function is similar to make_set
in APL. The main difference is that while values
returns all non-null values, make_set
specifically returns only unique values and stores them in an array.ANSI SQL users
GROUP_CONCAT
or ARRAY_AGG(DISTINCT)
functions are commonly used to aggregate unique values in a column. make_set
in APL works similarly by aggregating distinct values from a specific column into an array, but it offers better performance for large datasets.column
: The column from which unique values are aggregated.limit
: (Optional) The maximum number of unique values to return. Defaults to 128 if not specified.id | make_set_method |
---|---|
user123 | [‘GET’, ‘POST’] |
user456 | [‘GET’] |
id
and returns all unique HTTP methods used by each user.make_set
, but returns all values, including duplicates, in a list. Use make_list
if you want to preserve duplicates.count
when you need the total count rather than the unique values.dcount
when you need the number of unique values, rather than an array of them.max
when you are interested in the largest value rather than collecting values.