Aggregates
You will learn aggregate functions, intervals, compare, and URI normalization.
Functions
| UI label | API aggregate |
Needs numeric field? |
|---|---|---|
| Count | count |
No |
| Sum | sum |
Yes |
| Average | avg |
Yes |
| Max | max |
Yes |
| P50 | p50 |
Yes |
| P95 | p95 |
Yes |
| P99 | p99 |
Yes |
| Search (events) | events |
Projects learned fields |
Time buckets (interval)
| UI label | Token |
|---|---|
| None — table only | (omit) |
| 1 minute | 1m |
| 5 minutes | 5m |
| 15 minutes | 15m |
| 1 hour | 1h |
| 1 day | 1d |
With an interval, buckets are zero-filled across the selected range for charts.
Numeric aggregate rows include sample_count, the number of non-null field
values that participated in the calculation. Empty, zero-filled buckets report
zero samples.
In Query, select Inspect contributing events on a result row to search that bucket without losing the aggregate. Percentile and maximum investigations open the upper metric tail; minimum opens the lower tail. Select Back to aggregate to restore the original result.
A percentile is a distribution value rather than an event identity, so the inspection shows candidate tail events rather than claiming one event caused the percentile.
Normalize URI paths
When Group by is set, enable Normalize URI paths (normalize_uri: true)
to collapse UUID/hex/numeric path segments to {id}.
Example:
/v1/workspaces/550e8400-e29b-41d4-a716-446655440000/search
→ /v1/workspaces/{id}/search
Ignored for Search / events mode.
Period compare
On Query Aggregate, set Compare to Prior period. The same aggregate
runs over the equal-length window immediately before the primary range. Rows
include compare_value, delta, and pct_change; charts overlay the prior
series. Saving as an aggregate view keeps the compare setting.
REST and MCP use compare=prior_period. Not available with aggregate=events.