| Table of Contents | ||||
|---|---|---|---|---|
|
...
Argument | Data type |
|---|---|
Count | Any |
The data type of the aggregated values is integer.
Example
In the demosiem.logtrust.ecommerceweb.dataactivity table, we want to check the number of events in each 5-minute period and how many of them do not contain null IP addresses. Before aggregating the data, the table must be grouped in 5-minute intervals. Then we will perform two aggregations using the Count operation, one for the total number of events and one for those with a valid IP address.
Count 1
No arguments are needed for this first Count operation.
...
Click Aggregate function and you will see the following result:
...
Count 2
The arguments needed for this second Count operation are:
Count → clientIpAddress column
...
Click Aggregate function and you will see the following result:
...
How does it work in LINQ?
...
See Build a query using LINQ to learn more about grouping and aggregating your data using the LINQ language.
Examples
You can copy the following LINQ script and try the examples above on the demo.ecommerce.data table.
Count 1 (period total events)
| Code Block |
|---|
from demo.ecommerce.data group every 5m every 5m select count() as count |
Count 2 (field total events)
| Code Block |
|---|
from demo.ecommerce.data
group every 5m
every 5m
select count() as count,
count(clientIpAddress) as non_null_IP_addresses |
Count 3 (group total events)
In case you want to try another example with arguments when grouping, the following query shows the count of events for each method-statusCode unique occurrence every 10-minute period. In this case, no argument is specified in the Count operation.
| Code Block |
|---|
from demo.ecommerce.data
group every 10m by statusCode, method
every 10m
select count() as event_count |
Count 4 (field unique values)
If you want to know the number of unique values in a field (or unique value combinations if there are several fields), you can use the group select command with the count operation after grouping with the field in question as the only grouping key.
| Code Block |
|---|
from demo.ecommerce.data
group by statusCode
group select count() |