# Search Aggregations
source: https://docs.chalk.ai/docs/search-aggregations

## Summarize search results from logs, access logs, kube events, and spans with counts, percentiles, and other measures.

A search on its own returns a list of matching records. The aggregation row beneath the search bar allows you to
calculate summary statistics instead. It reads as a sentence:

The aggregation row: show Count unique of Pod Name, group by Component, top 100

Everything past top lives in the ··· advanced options, visible only once you have grouped by something.

The same row appears on the Logs, Access Logs, Kube Events, and Traces (Spans view)
explorers, and on dashboard data widgets. It is independent of the search bar above it, which filters
records using the syntax in Search Syntax.

The leading control is the view: List, the default, shows the matching records themselves.
Anything else is a measure, which replaces the list with a table of groups and draws one chart
series per group.

### Measures

| Measure          | Operates on    | Description                         |
| ---------------- | -------------- | ----------------------------------- |
| **Count**        | Records        | Number of matching records.         |
| **Count unique** | String fields  | Distinct values of a field.         |
| **Percentile**   | Numeric fields | p50, p95, and so on.                |
| **Mean**         | Numeric fields | Arithmetic mean.                    |
| **Max**          | Numeric fields | Largest value.                      |
| **Min**          | Numeric fields | Smallest value.                     |
| **Sum**          | Numeric fields | Total. Most useful for Kube Events. |

Every surface offers Count and Count unique; the numeric measures are only available on some:

- Access Logs and Spans offer the full set over duration.
- Kube Events offers Sum over count, the aggregated occurrence counter Kubernetes keeps. This is more useful than
the Count measure for most Kube Event searches. Other numerical measures are deliberately absent, as most statistics over an
already aggregated count are not useful.
- Logs have no numeric field, so Count and Count unique are the whole list.

### Grouping and Limiting

group by adds up to three dimensions, restricted to a fixed set of groupable fields (see
Fields By Surface) for performance reasons. With no dimension the result is a
single number over everything matched.

A table grouped by HTTP Path with top 5 and the (other) row folded into second place

top caps how many groups come back, i.e. rows in the table and series in the chart. Groups are
sorted server-side by the measure, so top 5 means the five groups with the largest value for the measure,
or the smallest value if you sort ascending.

(none) collects records whose grouped field is empty; set the relevant input to hide to exclude them.

(other) folds everything past the top cut into one row, ranked between the real groups. Folding needs a
measure that can be easily recombined from parts: currently Count, Sum, Min and Max
generate this row by default, while Mean, Count unique, and percentiles always omit it.

The header always tells you the total number of groups found in the time window.

### Comparing several measures

You can search for up to four measures in one query using the + button next to the first measure. The common case is
finding percentile skew for duration, or comparing mean and median. You might also want to compare both duration and
frequency between different groups.

An access-log chart with p50 and p95 of Duration drawn as two series

The table gains a column per measure. The chart draws a series per group and measure, so
three measures over five groups is fifteen series; top still counts groups, not series.

### Which measure ranks the result

Two measures ranked by p95 of Duration, whose column is pinned right with bars

With more than one measure, you can choose which one to order the groups by. sorted by chooses which
groups come back at all, not merely their order, and displays the selected measure on the far-right of the table
with green value bars. Above, operations counted 15 and 12 outrank one counted 3.78K,
because the ranking is by p95 rather than by volume.

### Mixed units

The measure family selector open, offering Count and Duration

Counts and duration statistics cannot share a chart axis meaningfully, so if you select both,
a selector above the chart groups measures into families and picks which family to draw.
Multiple percentiles are displayed together.

Only the chart on the explorer pages is affected: the table still shows every measure, and
dashboard charts have no such restrictions.

### Sharing and dashboards

The aggregation is part of the URL, so a link reproduces the chart and table you were looking at.

Any aggregation can also be saved as a dashboard widget - a timeseries, a table, or a single
statistic. A statistic reduces to one number, so it takes one measure and no grouping.