array_sum

Usage#

Syntax#

array_sum(array_expression)

Parameters#

Parameter	Type	Description
`array_expression`	array	An array of numerical values to be summed.

Returns#

The function returns the sum of all numerical values in the array. If the array is empty or contains no numerical values, the result is null.

Use case example#

Summing the duration of all events in an array field.

Query

['otel-demo-traces']
| summarize event_duration = make_list(duration) by ['service.name']
| extend total_event_duration = array_sum(event_duration)

Run in Playground

Output

service.name	total_event_duration
frontend	1667269530000
checkoutservice	3801404276900

The query calculates the total duration of all events for each service.

array_rotate_right: Rotates array elements to the right by a specified number of positions.
array_reverse: Reverses the order of array elements.
array_shift_left: Shifts array elements one position to the left, moving the first element to the last position.

Other query languages#

Splunk SPL users

In Splunk SPL, you might need to use commands or functions such as mvsum for similar operations. In APL, array_sum provides a direct method to compute the sum of numerical arrays.

Splunk example

| eval total_duration = mvsum(duration_array)

APL equivalent

['dataset.name']
| extend total_duration = array_sum(duration_array)

ANSI SQL users

ANSI SQL doesn’t natively support array operations like summing array elements. However, you can achieve similar results with UNNEST and SUM. In APL, array_sum simplifies this by handling array summation directly.

SQL example

SELECT SUM(value) AS total_duration
FROM UNNEST(duration_array) AS value;