Axiom
Overview

count

When to use count:

  • To count the total number of events in log analysis, such as the number of HTTP requests or errors.
  • To monitor system usage, such as the number of transactions or API calls.
  • To identify security incidents by counting failed login attempts or suspicious activities.

Usage#

Syntax#

summarize count() [by GroupingColumn]

Parameters#

  • GroupingColumn (optional): A column to group the count results by. If not specified, the total number of records across the dataset is returned.

Returns#

  • A table with the count of records for the entire dataset or grouped by the specified column.

Use case examples#

In log analysis, you can count the number of HTTP requests by status to get a sense of how many requests result in different HTTP status codes.

Query

['sample-http-logs']
| summarize count() by status

Run in Playground

Output

status count
200 1500
404 200

This query counts the total number of HTTP requests for each status code in the logs.

For OpenTelemetry traces, you can count the total number of spans for each service, which helps you monitor the distribution of requests across services.

Query

['otel-demo-traces']
| summarize count() by ['service.name']

Run in Playground

Output

service.name count
frontend 1000
cartservice 500

This query counts the number of spans for each service in the OpenTelemetry traces dataset.

In security logs, you can count the number of requests by country to identify where the majority of traffic or suspicious activity originates.

Query

['sample-http-logs']
| summarize count() by ['geo.country']

Run in Playground

Output

geo.country count
US 3000
DE 500

This query counts the number of requests originating from each country.

  • sum: Use sum to calculate the total sum of a numeric field, as opposed to counting the number of records.
  • avg: The avg function calculates the average of a numeric field. Use it when you want to determine the mean value of data instead of the count.
  • min: The min function returns the minimum value of a numeric field, helping to identify the smallest value in a dataset.
  • max: The max function returns the maximum value of a numeric field, useful for identifying the largest value.
  • countif: The countif function allows you to count only records that meet specific conditions, giving you more flexibility in your count queries.

Other query languages#

Splunk SPL users

In Splunk SPL, the count function works similarly to APL, but the syntax differs slightly.

Splunk example

| stats count by status

APL equivalent

['sample-http-logs']
| summarize count() by status
ANSI SQL users

In ANSI SQL, the count function works similarly, but APL uses different syntax for querying.

SQL example

SELECT status, COUNT(*)
FROM sample_http_logs
GROUP BY status

APL equivalent

['sample-http-logs']
| summarize count() by status

Updated

Was this page helpful?