|
1 | 1 | ---
|
2 |
| -title: 'count' |
3 |
| -description: 'Learn how to return the number of events from your input dataset.' |
4 |
| -tags: |
5 |
| - ['axiom documentation', 'documentation', 'axiom', 'tabular operators', 'count'] |
| 2 | +title: count |
| 3 | +description: 'This page explains how to use the count operator function in APL.' |
6 | 4 | ---
|
7 | 5 |
|
8 |
| -Returns the number of events from the input dataset. |
| 6 | +The `count` operator in Axiom Processing Language (APL) is a simple yet powerful aggregation function that returns the total number of records in a dataset. You can use it to calculate the number of rows in a table or the results of a query. The `count` operator is useful in scenarios such as log analysis, telemetry data processing, and security monitoring, where you need to know how many events, transactions, or data entries match certain criteria. |
9 | 7 |
|
10 |
| -## Syntax |
| 8 | +## For users of other query languages |
11 | 9 |
|
12 |
| -```kusto |
| 10 | +If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL. |
| 11 | + |
| 12 | +<AccordionGroup> |
| 13 | +<Accordion title="Splunk SPL users"> |
| 14 | + |
| 15 | +In Splunk’s SPL, the `stats count` function is used to count the number of events in a dataset. In APL, the equivalent operation is simply `count`. You can use `count` in APL without the need for additional function wrapping. |
| 16 | + |
| 17 | +<CodeGroup> |
| 18 | +```splunk Splunk example |
| 19 | +index=web_logs |
| 20 | +| stats count |
| 21 | +``` |
| 22 | + |
| 23 | +```kusto APL equivalent |
| 24 | +['sample-http-logs'] |
13 | 25 | | count
|
14 | 26 | ```
|
| 27 | +</CodeGroup> |
15 | 28 |
|
16 |
| -[Run in Playground](https://play.axiom.co/axiom-play-qf1k/explorer?initForm={%22apl%22:%22[%27sample-http-logs%27]\n|%20count%22,%22queryOptions%22:{%22quickRange%22:%2230d%22}}) |
| 29 | +</Accordion> |
| 30 | +<Accordion title="ANSI SQL users"> |
| 31 | + |
| 32 | +In ANSI SQL, you typically use `COUNT(*)` or `COUNT(field)` to count the number of rows in a table. In APL, the `count` operator achieves the same functionality, but it doesn’t require a field name or `*`. |
| 33 | + |
| 34 | +<CodeGroup> |
| 35 | +```sql SQL example |
| 36 | +SELECT COUNT(*) FROM web_logs; |
| 37 | +``` |
| 38 | + |
| 39 | +```kusto APL equivalent |
| 40 | +['sample-http-logs'] |
| 41 | +| count |
| 42 | +``` |
| 43 | +</CodeGroup> |
17 | 44 |
|
18 |
| -## Returns |
| 45 | +</Accordion> |
| 46 | +</AccordionGroup> |
19 | 47 |
|
20 |
| -This function returns a table with a single data and column. The value of the only cell is the number of events in the dataset. |
| 48 | +## Usage |
21 | 49 |
|
22 |
| -## Examples |
| 50 | +### Syntax |
23 | 51 |
|
24 | 52 | ```kusto
|
25 |
| -['http-logs'] |
26 |
| -| where method == 'GET' |
27 | 53 | | count
|
28 | 54 | ```
|
29 | 55 |
|
30 |
| -[Run in Playground](https://play.axiom.co/axiom-play-qf1k/explorer?initForm={%22apl%22:%22[%27sample-http-logs%27]\n|%20where%20method%20==%20%27GET%27\n|%20count%22,%22queryOptions%22:{%22quickRange%22:%2230d%22}}) |
| 56 | +### Parameters |
| 57 | + |
| 58 | +The `count` operator does not take any parameters. It simply returns the number of records in the dataset or query result. |
| 59 | + |
| 60 | +### Returns |
| 61 | + |
| 62 | +`count` returns an integer representing the total number of records in the dataset. |
| 63 | + |
| 64 | +## Use case examples |
| 65 | + |
| 66 | +<Tabs> |
| 67 | +<Tab title="Log analysis"> |
| 68 | + |
| 69 | +In this example, you count the total number of HTTP requests in the `['sample-http-logs']` dataset. |
| 70 | + |
| 71 | +**Query** |
31 | 72 |
|
32 | 73 | ```kusto
|
33 |
| -['http-logs'] |
| 74 | +['sample-http-logs'] |
34 | 75 | | count
|
35 | 76 | ```
|
36 | 77 |
|
37 |
| -[Run in Playground](https://play.axiom.co/axiom-play-qf1k/explorer?initForm=%7B%22apl%22%3A%22%5B%27sample-http-logs%27%5D%5Cn%7C%20count%22%2C%22queryOptions%22%3A%7B%22quickRange%22%3A%2230d%22%7D%7D) |
| 78 | +[Run in Playground](https://play.axiom.co/axiom-play-qf1k/explorer?initForm=%7B%22apl%22%3A%22%5B'sample-http-logs'%5D%20%7C%20count%22%7D) |
| 79 | + |
| 80 | +**Output** |
| 81 | + |
| 82 | +| count | |
| 83 | +|-------| |
| 84 | +| 15000 | |
| 85 | + |
| 86 | +This query returns the total number of HTTP requests recorded in the logs. |
| 87 | + |
| 88 | +</Tab> |
| 89 | +<Tab title="OpenTelemetry traces"> |
| 90 | + |
| 91 | +In this example, you count the number of traces in the `['otel-demo-traces']` dataset. |
| 92 | + |
| 93 | +**Query** |
| 94 | + |
| 95 | +```kusto |
| 96 | +['otel-demo-traces'] | |
| 97 | +count |
| 98 | +``` |
| 99 | + |
| 100 | +[Run in Playground](https://play.axiom.co/axiom-play-qf1k/explorer?initForm=%7B%22apl%22%3A%22%5B'otel-demo-traces'%5D%20%7C%20count%22%7D) |
| 101 | + |
| 102 | +**Output** |
| 103 | + |
| 104 | +| count | |
| 105 | +|-------| |
| 106 | +| 5000 | |
| 107 | + |
| 108 | +This query returns the total number of OpenTelemetry traces in the dataset. |
| 109 | + |
| 110 | +</Tab> |
| 111 | +<Tab title="Security logs"> |
| 112 | + |
| 113 | +In this example, you count the number of security events in the `['sample-http-logs']` dataset where the status code indicates an error (status codes 4xx or 5xx). |
| 114 | + |
| 115 | +**Query** |
| 116 | + |
| 117 | +```kusto |
| 118 | +['sample-http-logs'] | |
| 119 | +where status startswith '4' or status startswith '5' | |
| 120 | +count |
| 121 | +``` |
| 122 | + |
| 123 | +[Run in Playground](https://play.axiom.co/axiom-play-qf1k/explorer?initForm=%7B%22apl%22%3A%22%5B'sample-http-logs'%5D%20%7C%20where%20status%20startswith%20'4'%20or%20status%20startswith%20'5'%20%7C%20count%22%7D) |
| 124 | + |
| 125 | +**Output** |
| 126 | + |
| 127 | +| count | |
| 128 | +|-------| |
| 129 | +| 1200 | |
| 130 | + |
| 131 | +This query returns the number of HTTP requests that resulted in an error (HTTP status code 4xx or 5xx). |
| 132 | + |
| 133 | +</Tab> |
| 134 | +</Tabs> |
| 135 | + |
| 136 | +## List of related operators |
| 137 | + |
| 138 | +- [**summarize**](/apl/tabular-operators/summarize-operator): The `summarize` operator is used to aggregate data based on one or more fields, allowing you to calculate sums, averages, and other statistics, including counts. Use `summarize` when you need to group data before counting. |
| 139 | +- [**extend**](/apl/tabular-operators/extend-operator): The `extend` operator adds calculated fields to a dataset. You can use `extend` alongside `count` if you want to add additional calculated data to your query results. |
| 140 | +- [**project**](/apl/tabular-operators/project-operator): The `project` operator selects specific fields from a dataset. While `count` returns the total number of records, `project` can limit or change which fields you see. |
| 141 | +- [**where**](/apl/tabular-operators/where-operator): The `where` operator filters rows based on a condition. Use `where` with `count` to only count records that meet certain criteria. |
| 142 | +- [**take**](/apl/tabular-operators/take-operator): The `take` operator returns a specified number of records. You can use `take` to limit results before applying `count` if you're interested in counting a sample of records. |
0 commit comments