Axiom
Overview

count

Usage#

Syntax#

| count

Parameters#

The count operator doesn’t take any parameters. It simply returns the number of records in the dataset or query result.

Returns#

count returns an integer representing the total number of records in the dataset.

Use case examples#

In this example, you count the total number of HTTP requests in the ['sample-http-logs'] dataset.

Query

['sample-http-logs']
| count

Run in Playground

Output

count
15000

This query returns the total number of HTTP requests recorded in the logs.

In this example, you count the number of traces in the ['otel-demo-traces'] dataset.

Query

['otel-demo-traces'] |
count

Run in Playground

Output

count
5000

This query returns the total number of OpenTelemetry traces in the dataset.

In this example, you count the number of security events in the ['sample-http-logs'] dataset where the status code indicates an error (status codes 4xx or 5xx).

Query

['sample-http-logs'] |
where status startswith '4' or status startswith '5' |
count

Run in Playground

Output

count
1200

This query returns the number of HTTP requests that resulted in an error (HTTP status code 4xx or 5xx).

  • summarize: The summarize operator is used to aggregate data based on one or more fields, allowing you to calculate sums, averages, and other statistics, including counts. Use summarize when you need to group data before counting.
  • extend: The extend operator adds calculated fields to a dataset. You can use extend alongside count if you want to add additional calculated data to your query results.
  • project: The project operator selects specific fields from a dataset. While count returns the total number of records, project can limit or change which fields you see.
  • where: The where operator filters rows based on a condition. Use where with count to only count records that meet certain criteria.
  • take: The take operator returns a specified number of records. You can use take to limit results before applying count if you’re interested in counting a sample of records.

Other query languages#

Splunk SPL users

In Splunk’s SPL, the stats count function is used to count the number of events in a dataset. In APL, the equivalent operation is simply count. You can use count in APL without the need for additional function wrapping.

Splunk example

index=web_logs
| stats count

APL equivalent

['sample-http-logs']
| count
ANSI SQL users

In ANSI SQL, you typically use COUNT(*) or COUNT(field) to count the number of rows in a table. In APL, the count operator achieves the same functionality, but it doesn’t require a field name or *.

SQL example

SELECT COUNT(*) FROM web_logs;

APL equivalent

['sample-http-logs']
| count

Updated

Was this page helpful?