Axiom
Overview

min

Usage#

Syntax#

summarize min(Expression)

Parameters#

  • Expression: The expression from which to calculate the minimum value. Typically, this is a numeric or date/time field.

Returns#

The function returns the smallest value found in the specified column or expression.

Use case examples#

In this use case, you analyze HTTP logs to find the minimum request duration for each unique user.

Query

['sample-http-logs']
| summarize min(req_duration_ms) by id

Run in Playground

Output

id min_req_duration_ms
user_123 32
user_456 45

This query returns the minimum request duration for each user, helping you identify the fastest responses.

Here, you analyze OpenTelemetry trace data to find the minimum span duration per service.

Query

['otel-demo-traces']
| summarize min(duration) by ['service.name']

Run in Playground

Output

service.name min_duration
frontend 2ms
checkoutservice 5ms

This query returns the minimum span duration for each service in the trace logs.

In this example, you analyze security logs to find the minimum request duration for each HTTP status code.

Query

['sample-http-logs']
| summarize min(req_duration_ms) by status

Run in Playground

Output

status min_req_duration_ms
200 10
404 40

This query returns the minimum request duration for each HTTP status code, helping you identify if certain statuses are associated with faster or slower response times.

  • max: Returns the maximum value from a set of values. Use max when you need to find the highest value instead of the lowest.
  • avg: Calculates the average of a set of values. Use avg to find the mean value instead of the minimum.
  • count: Counts the number of records or distinct values. Use count when you need to know how many records or unique values exist, rather than calculating the minimum.
  • sum: Adds all values together. Use sum when you need the total of a set of values rather than the minimum.
  • percentile: Returns the value at a specified percentile. Use percentile if you need a value that falls at a certain point in the distribution of your data, rather than the minimum.

Other query languages#

Splunk SPL users

In Splunk, the min function works similarly to APL's min aggregation, allowing you to find the minimum value in a field across your dataset. The main difference is in the query structure and syntax between the two.

Splunk example

| stats min(duration) by id

APL equivalent

['sample-http-logs']
| summarize min(req_duration_ms) by id
ANSI SQL users

In ANSI SQL, the MIN function works almost identically to the APL min aggregation. You use it to return the smallest value in a column of data, grouped by one or more fields.

SQL example

SELECT MIN(duration), id FROM sample_http_logs GROUP BY id;

APL equivalent

['sample-http-logs']
| summarize min(req_duration_ms) by id

Updated

Was this page helpful?