Axiom
Overview

make_list_if

This aggregation is ideal in scenarios where filtering at the aggregation level is required, such as gathering only the successful requests or collecting trace spans of a specific service in OpenTelemetry data. It’s particularly useful when analyzing logs, tracing information, or security events, where conditional aggregation is essential for understanding trends or identifying issues.

Usage#

Syntax#

summarize make_list_if(expression, condition)

Parameters#

  • expression: The field or expression whose values will be included in the list.
  • condition: A Boolean condition that determines which values from expression are included in the result.

Returns#

The function returns an array containing all values from expression that meet the specified condition.

Use case examples#

In this example, we will gather a list of request durations for successful HTTP requests.

Query

['sample-http-logs']
| summarize make_list_if(req_duration_ms, status == '200') by id

Run in Playground

Output

id req_duration_ms_list
123 [100, 150, 200]
456 [300, 350, 400]

This query aggregates request durations for HTTP requests that returned a status of ‘200’ for each user ID.

Here, we will aggregate the span durations for cartservice where the status code indicates success.

Query

['otel-demo-traces']
| summarize make_list_if(duration, status_code == '200' and ['service.name'] == 'cartservice') by trace_id

Run in Playground

Output

trace_id duration_list
abc123 [00:01:23, 00:01:45]
def456 [00:02:12, 00:03:15]

This query collects span durations for successful requests to the cartservice by trace_id.

In this case, we gather a list of IP addresses from security logs where the HTTP status is 403 (Forbidden) and group them by the country of origin.

Query

['sample-http-logs']
| summarize make_list_if(uri, status == '403') by ['geo.country']

Run in Playground

Output

geo.country uri_list
USA ['/login', '/admin']
Canada ['/admin', '/secure']

This query collects a list of URIs that resulted in a 403 error, grouped by the country where the request originated.

  • make_list: Aggregates all values into a list without any conditions. Use make_list when you don’t need to filter the values based on a condition.
  • countif: Counts the number of records that satisfy a specific condition. Use countif when you need a count of occurrences rather than a list of values.
  • avgif: Calculates the average of values that meet a specified condition. Use avgif for numerical aggregations where you want a conditional average instead of a list.

Other query languages#

Splunk SPL users

In Splunk, you would typically use the eval and stats commands to create conditional lists. In APL, the make_list_if function serves a similar purpose by allowing you to aggregate data into a list based on a condition.

Splunk example

| stats list(field) as field_list by condition

APL equivalent

summarize make_list_if(field, condition)
ANSI SQL users

In ANSI SQL, conditional aggregation often involves the use of CASE statements combined with aggregation functions such as ARRAY_AGG. In APL, make_list_if directly applies a condition to the aggregation.

SQL example

SELECT ARRAY_AGG(CASE WHEN condition THEN field END) FROM table

APL equivalent

summarize make_list_if(field, condition)

Updated

Was this page helpful?