This page explains how to use the summarize operator function in APL.
summarize
operator in APL enables you to perform data aggregation and create summary tables from large datasets. You can use it to group data by specified fields and apply aggregation functions such as count()
, sum()
, avg()
, min()
, max()
, and many others. This is particularly useful when analyzing logs, tracing OpenTelemetry data, or reviewing security events. The summarize
operator is helpful when you want to reduce the granularity of a dataset to extract insights or trends.
Splunk SPL users
stats
command performs a similar function to APL’s summarize
operator. Both operators are used to group data and apply aggregation functions. In APL, summarize
is more explicit about the fields to group by and the aggregation functions to apply.ANSI SQL users
summarize
operator in APL is conceptually similar to SQL’s GROUP BY
clause with aggregation functions. In APL, you explicitly specify the aggregation function (like count()
, sum()
) and the fields to group by.Field1
: A field name.AggregationFunction
: The aggregation function to apply. Examples include count()
, sum()
, avg()
, min()
, and max()
.GroupExpression
: A scalar expression that can reference the dataset.summarize
operator returns a table where:
by
expressions.by
fields and also at least one field for each computed aggregate. Some aggregation functions return multiple fields.summarize
to count the number of HTTP requests grouped by method, or to compute the average request duration.Querymethod | count_ |
---|---|
GET | 1000 |
POST | 450 |
method
field and counts how many times each method is used.HISTOGRAM(req_duration_ms)
.