Skip to content

Commit 09b19b0

Browse files
authored
Rewrite docs on tabular operators (#123)
1 parent 3e79faf commit 09b19b0

22 files changed

+2558
-571
lines changed

apl/guides/exploring-the-union-operator-in-apl.mdx

-141
This file was deleted.
+121-16
Original file line numberDiff line numberDiff line change
@@ -1,37 +1,142 @@
11
---
2-
title: 'count'
3-
description: 'Learn how to return the number of events from your input dataset.'
4-
tags:
5-
['axiom documentation', 'documentation', 'axiom', 'tabular operators', 'count']
2+
title: count
3+
description: 'This page explains how to use the count operator function in APL.'
64
---
75

8-
Returns the number of events from the input dataset.
6+
The `count` operator in Axiom Processing Language (APL) is a simple yet powerful aggregation function that returns the total number of records in a dataset. You can use it to calculate the number of rows in a table or the results of a query. The `count` operator is useful in scenarios such as log analysis, telemetry data processing, and security monitoring, where you need to know how many events, transactions, or data entries match certain criteria.
97

10-
## Syntax
8+
## For users of other query languages
119

12-
```kusto
10+
If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.
11+
12+
<AccordionGroup>
13+
<Accordion title="Splunk SPL users">
14+
15+
In Splunk’s SPL, the `stats count` function is used to count the number of events in a dataset. In APL, the equivalent operation is simply `count`. You can use `count` in APL without the need for additional function wrapping.
16+
17+
<CodeGroup>
18+
```splunk Splunk example
19+
index=web_logs
20+
| stats count
21+
```
22+
23+
```kusto APL equivalent
24+
['sample-http-logs']
1325
| count
1426
```
27+
</CodeGroup>
1528

16-
[Run in Playground](https://play.axiom.co/axiom-play-qf1k/explorer?initForm={%22apl%22:%22[%27sample-http-logs%27]\n|%20count%22,%22queryOptions%22:{%22quickRange%22:%2230d%22}})
29+
</Accordion>
30+
<Accordion title="ANSI SQL users">
31+
32+
In ANSI SQL, you typically use `COUNT(*)` or `COUNT(field)` to count the number of rows in a table. In APL, the `count` operator achieves the same functionality, but it doesn’t require a field name or `*`.
33+
34+
<CodeGroup>
35+
```sql SQL example
36+
SELECT COUNT(*) FROM web_logs;
37+
```
38+
39+
```kusto APL equivalent
40+
['sample-http-logs']
41+
| count
42+
```
43+
</CodeGroup>
1744

18-
## Returns
45+
</Accordion>
46+
</AccordionGroup>
1947

20-
This function returns a table with a single data and column. The value of the only cell is the number of events in the dataset.
48+
## Usage
2149

22-
## Examples
50+
### Syntax
2351

2452
```kusto
25-
['http-logs']
26-
| where method == 'GET'
2753
| count
2854
```
2955

30-
[Run in Playground](https://play.axiom.co/axiom-play-qf1k/explorer?initForm={%22apl%22:%22[%27sample-http-logs%27]\n|%20where%20method%20==%20%27GET%27\n|%20count%22,%22queryOptions%22:{%22quickRange%22:%2230d%22}})
56+
### Parameters
57+
58+
The `count` operator does not take any parameters. It simply returns the number of records in the dataset or query result.
59+
60+
### Returns
61+
62+
`count` returns an integer representing the total number of records in the dataset.
63+
64+
## Use case examples
65+
66+
<Tabs>
67+
<Tab title="Log analysis">
68+
69+
In this example, you count the total number of HTTP requests in the `['sample-http-logs']` dataset.
70+
71+
**Query**
3172

3273
```kusto
33-
['http-logs']
74+
['sample-http-logs']
3475
| count
3576
```
3677

37-
[Run in Playground](https://play.axiom.co/axiom-play-qf1k/explorer?initForm=%7B%22apl%22%3A%22%5B%27sample-http-logs%27%5D%5Cn%7C%20count%22%2C%22queryOptions%22%3A%7B%22quickRange%22%3A%2230d%22%7D%7D)
78+
[Run in Playground](https://play.axiom.co/axiom-play-qf1k/explorer?initForm=%7B%22apl%22%3A%22%5B'sample-http-logs'%5D%20%7C%20count%22%7D)
79+
80+
**Output**
81+
82+
| count |
83+
|-------|
84+
| 15000 |
85+
86+
This query returns the total number of HTTP requests recorded in the logs.
87+
88+
</Tab>
89+
<Tab title="OpenTelemetry traces">
90+
91+
In this example, you count the number of traces in the `['otel-demo-traces']` dataset.
92+
93+
**Query**
94+
95+
```kusto
96+
['otel-demo-traces'] |
97+
count
98+
```
99+
100+
[Run in Playground](https://play.axiom.co/axiom-play-qf1k/explorer?initForm=%7B%22apl%22%3A%22%5B'otel-demo-traces'%5D%20%7C%20count%22%7D)
101+
102+
**Output**
103+
104+
| count |
105+
|-------|
106+
| 5000 |
107+
108+
This query returns the total number of OpenTelemetry traces in the dataset.
109+
110+
</Tab>
111+
<Tab title="Security logs">
112+
113+
In this example, you count the number of security events in the `['sample-http-logs']` dataset where the status code indicates an error (status codes 4xx or 5xx).
114+
115+
**Query**
116+
117+
```kusto
118+
['sample-http-logs'] |
119+
where status startswith '4' or status startswith '5' |
120+
count
121+
```
122+
123+
[Run in Playground](https://play.axiom.co/axiom-play-qf1k/explorer?initForm=%7B%22apl%22%3A%22%5B'sample-http-logs'%5D%20%7C%20where%20status%20startswith%20'4'%20or%20status%20startswith%20'5'%20%7C%20count%22%7D)
124+
125+
**Output**
126+
127+
| count |
128+
|-------|
129+
| 1200 |
130+
131+
This query returns the number of HTTP requests that resulted in an error (HTTP status code 4xx or 5xx).
132+
133+
</Tab>
134+
</Tabs>
135+
136+
## List of related operators
137+
138+
- [**summarize**](/apl/tabular-operators/summarize-operator): The `summarize` operator is used to aggregate data based on one or more fields, allowing you to calculate sums, averages, and other statistics, including counts. Use `summarize` when you need to group data before counting.
139+
- [**extend**](/apl/tabular-operators/extend-operator): The `extend` operator adds calculated fields to a dataset. You can use `extend` alongside `count` if you want to add additional calculated data to your query results.
140+
- [**project**](/apl/tabular-operators/project-operator): The `project` operator selects specific fields from a dataset. While `count` returns the total number of records, `project` can limit or change which fields you see.
141+
- [**where**](/apl/tabular-operators/where-operator): The `where` operator filters rows based on a condition. Use `where` with `count` to only count records that meet certain criteria.
142+
- [**take**](/apl/tabular-operators/take-operator): The `take` operator returns a specified number of records. You can use `take` to limit results before applying `count` if you're interested in counting a sample of records.

0 commit comments

Comments
 (0)