Axiom
Overview

rate

The rate function is useful for analyzing trends in time series data and identifying unusual spikes or drops in activity. It can help you understand patterns in logs, metrics, and traces over specific intervals, such as per minute, per second, or per hour.

Usage#

Syntax#

rate(field)

Parameters#

  • field: The numeric field for which you want to calculate the rate.

Returns#

Returns the rate of change or occurrence of the specified field over the time interval specified in the query.

Specify the time interval in the query in the following way:

  • | summarize rate(field) calculates the rate value of the field over the entire query window.
  • | summarize rate(field) by bin(_time, 1h) calculates the rate value of the field over a one-hour time window.
  • | summarize rate(field) by bin_auto(_time) calculates the rate value of the field bucketed by an automatic time window computed by bin_auto().

Use two summarize statements to visualize the average rate over one minute per hour. For example:

['sample-http-logs']
| summarize respBodyRate = rate(resp_body_size_bytes) by bin(_time, 1m)
| summarize avg(respBodyRate) by bin(_time, 1h)

Run in Playground

Use case examples#

In this example, the rate aggregation calculates the rate of HTTP response sizes per second.

Query

['sample-http-logs']
| summarize rate(resp_body_size_bytes) by bin(_time, 1s)

Run in Playground

Output

rate _time
854 kB 2024-01-01 12:00:00
635 kB 2024-01-01 12:00:01

This query calculates the rate of HTTP response sizes per second.

This example calculates the rate of span duration per second.

Query

['otel-demo-traces']
| summarize rate(toint(duration)) by bin(_time, 1s)

Run in Playground

Output

rate _time
26,393,768 2024-01-01 12:00:00
19,303,456 2024-01-01 12:00:01

This query calculates the rate of span duration per second.

In this example, the rate aggregation calculates the rate of HTTP request duration per second which can be useful to detect an increate in malicious requests.

Query

['sample-http-logs']
| summarize rate(req_duration_ms) by bin(_time, 1s)

Run in Playground

Output

rate _time
240.668 ms 2024-01-01 12:00:00
264.17 ms 2024-01-01 12:00:01

This query calculates the rate of HTTP request duration per second.

  • count: Returns the total number of records. Use count when you want an absolute total instead of a rate over time.
  • sum: Returns the sum of values in a field. Use sum when you want to aggregate the total value, not its rate of change.
  • avg: Returns the average value of a field. Use avg when you want to know the mean value rather than how it changes over time.
  • max: Returns the maximum value of a field. Use max when you need to find the peak value instead of how often or quickly something occurs.
  • min: Returns the minimum value of a field. Use min when you’re looking for the lowest value rather than a rate.

Other query languages#

Splunk SPL users

In Splunk SPL, the equivalent of the rate function can be achieved using the timechart command with a per_second option or by calculating the difference between successive values over time. In APL, the rate function simplifies this process by directly calculating the rate over a specified time interval.

Splunk example

| timechart per_second count by resp_body_size_bytes

APL equivalent

['sample-http-logs']
| summarize rate(resp_body_size_bytes) by bin(_time, 1s)
ANSI SQL users

In ANSI SQL, calculating rates typically involves using window functions like LAG or LEAD to calculate the difference between successive rows in a time series. In APL, the rate function abstracts this complexity by allowing you to directly compute the rate over time without needing window functions.

SQL example

SELECT resp_body_size_bytes, COUNT(*) / TIMESTAMPDIFF(SECOND, MIN(_time), MAX(_time)) AS rate
FROM http_logs;

APL equivalent

['sample-http-logs']
| summarize rate(resp_body_size_bytes) by bin(_time, 1s)

Updated

Was this page helpful?