Aggregation Operators

Aggregation operators help aggregate log messages into groups.

FuseQL applies aggregations after applying the filters specified in the log search bar, and in the time range selected in the time picker. FuseQL groups all aggregations by time buckets, unless the user specifies additional grouping using the dropdown.

Kloudfuse automatically selects the count and count_unique operators by default, depending on the data type of the variable. For other operators, click the drop-down next to the show (Show) label, and select the aggregation operator.

FuseQL supports these aggregator types:

Counting operators: count and count_unique
Statistical operators: min, max, avg, sum, stddev, stdvar, and percentiles
Ordered aggregation operators: first and last

Here is the comprehensive list of aggregation operators:

avg: Computes the average of numeric values.
count: Counts the total number of log lines.
count_unique: Counts only unique or distinct occurrences of the field.
first: Computes the first of numeric values.
last: Computes the last of numeric values.
max: Computes the maximum of numeric values.
min: Computes the minimum of numeric values.
percentiles: Computes the percentiles (p50, p75, p90, p95 or p99) of numeric values.
stddev: Computes the standard deviation of numeric or duration-valued facets.
stdvar: Computes the standard variance of numeric or duration-valued facets.
sum: Computes the sum of numeric or duration-valued facets.