Count (count)

[ 1 Description ] [ 2 How does it work in the search window? ] [ 3 How does it work in LINQ? ]

Description

This operation calculates the total number of events for each grouping occurrence.

How does it work in the search window?

You can use this operation in two different ways:

If you use it with no arguments, it returns the number of events for each grouping occurrence.
If you specify an argument, it returns the number of non-null values found in that column for each grouping occurrence.

Before being able to perform this operation, you have to group your data. Be aware that the columns used as arguments for the grouping operation will not be available to select as arguments for the aggregation operation.

After grouping the data, select Aggregation in the search window toolbar, then select the Count operation. As said before, this operation works both with and without arguments.

Argument	Data type

Argument	Data type
Count	Any

The data type of the aggregated values is integer.

Example

In the siem.logtrust.web.activity table, we want to check the number of events in each 5-minute period and how many of them do not contain null IP addresses. Before aggregating the data, the table must be grouped in 5-minute intervals. Then we will perform two aggregations using the Count operation, one for the total number of events and one for those with a valid IP address.

Count 1

No arguments are needed for this first Count operation.

Click Aggregate function and you will see the following result:

Count 2

The arguments needed for this second Count operation are:

Count → clientIpAddress column

Click Aggregate function and you will see the following result:

How does it work in LINQ?

Group your data using the following structure:

group every server period by column1, column2...
every client period

Then, use select... as... to add the new column that will show the aggregated values. These are the valid syntaxes for the Count operation:

count() → Returns the number of events for each grouping occurrence.
count(column) → Returns the number of non-null values found in that column for each grouping occurrence.

See Build a query using LINQ to learn more about grouping and aggregating your data using the LINQ language.

Examples

You can copy the following LINQ script and try the examples above on the demo.ecommerce.data table.

Count 1 (period total events)

from demo.ecommerce.data
  group every 5m
  every 5m
  select count() as count

Count 2 (field total events)

from demo.ecommerce.data
  group every 5m
  every 5m
  select count() as count,
    count(clientIpAddress) as non_null_IP_addresses

Count 3 (group total events)

In case you want to try another example with arguments when grouping, the following query shows the count of events for each method-statusCode unique occurrence every 10-minute period. In this case, no argument is specified in the Count operation.

from demo.ecommerce.data
  group every 10m by statusCode, method
  every 10m
  select count() as event_count

Count 4 (field unique values)

If you want to know the number of unique values in a field (or unique value combinations if there are several fields), you can use the group select command with the count operation after grouping with the field in question as the only grouping key.