Search Aggregations

A search on its own returns a list of matching records. The aggregation row beneath the search bar allows you to calculate summary statistics instead. It reads as a sentence:

Everything past top lives in the ··· advanced options, visible only once you have grouped by something.

The same row appears on the Logs, Access Logs, Kube Events, and Traces (Spans view) explorers, and on dashboard data widgets. It is independent of the search bar above it, which filters records using the syntax in Search Syntax.

The leading control is the view: List, the default, shows the matching records themselves. Anything else is a measure, which replaces the list with a table of groups and draws one chart series per group.

​

Measures

Every surface offers Count and Count unique; the numeric measures are only available on some:

• Access Logs and Spans offer the full set over duration.
• Kube Events offers Sum over count, the aggregated occurrence counter Kubernetes keeps. This is more useful than the Count measure for most Kube Event searches. Other numerical measures are deliberately absent, as most statistics over an already aggregated count are not useful.
• Logs have no numeric field, so Count and Count unique are the whole list.

​

Grouping and Limiting

group by adds up to three dimensions, restricted to a fixed set of groupable fields (see Fields By Surface) for performance reasons. With no dimension the result is a single number over everything matched.

top caps how many groups come back, i.e. rows in the table and series in the chart. Groups are sorted server-side by the measure, so top 5 means the five groups with the largest value for the measure, or the smallest value if you sort ascending.

(none) collects records whose grouped field is empty; set the relevant input to hide to exclude them.

(other) folds everything past the top cut into one row, ranked between the real groups. Folding needs a measure that can be easily recombined from parts: currently Count, Sum, Min and Max generate this row by default, while Mean, Count unique, and percentiles always omit it.

The header always tells you the total number of groups found in the time window.

​

Comparing several measures

You can search for up to four measures in one query using the + button next to the first measure. The common case is finding percentile skew for duration, or comparing mean and median. You might also want to compare both duration and frequency between different groups.

The table gains a column per measure. The chart draws a series per group and measure, so three measures over five groups is fifteen series; top still counts groups, not series.

​

Which measure ranks the result

With more than one measure, you can choose which one to order the groups by. sorted by chooses which groups come back at all, not merely their order, and displays the selected measure on the far-right of the table with green value bars. Above, operations counted 15 and 12 outrank one counted 3.78K, because the ranking is by p95 rather than by volume.

​

Mixed units

Counts and duration statistics cannot share a chart axis meaningfully, so if you select both, a selector above the chart groups measures into families and picks which family to draw. Multiple percentiles are displayed together.

Only the chart on the explorer pages is affected: the table still shows every measure, and dashboard charts have no such restrictions.

​

Sharing and dashboards

The aggregation is part of the URL, so a link reproduces the chart and table you were looking at.

Any aggregation can also be saved as a dashboard widget - a timeseries, a table, or a single statistic. A statistic reduces to one number, so it takes one measure and no grouping.