Multiple Aggregation Operators

When working with numerical data in Advanced Search mode, you can use multiple FuseQL aggregation operators in the same query. Simply "pipe" the result of the previous step into the a comma-separated list of aggregate operators. Then select to view the corresponding options in the chart.

For example,

  1. Navigate to the Logs > Time Series page.

  2. Turn on Advanced Search option.

  3. Combine count and max aggregators over a numeric facet to issue the following query:

    * | timeslice 5s |
  count as number, (1)
  max(@_number_0) as maximum  (2)
  by (_timeslice)
    1 count: aliased as number
    2 max: aliased as maximum

  4. Click run (Run).

  5. Kloudfuse generates a time series graph with two options: Number (count) and Maximum (max).

    Use the Aggregate drop-down to select the chart you plan to examine.

    • number

    • maximum

    Count][[count]
    Max][[max]