arg_max
This page explains how to use the arg_max aggregation in APL.
The arg_max aggregation in APL helps you identify the row with the maximum value for an expression and return additional fields from that record. Use arg_max when you want to determine key details associated with a row where the expression evaluates to the maximum value. If you group your data, arg_max finds the row within each group where a particular expression evaluates to the maximum value.
This aggregation is particularly useful in scenarios like the following:
- Pinpoint the slowest HTTP requests in log data and retrieve associated details (like URL, status code, and user agent) for the same row.
- Identify the longest span durations in OpenTelemetry traces with additional context (like span name, trace ID, and attributes) for the same row.
- Highlight the highest severity security alerts in logs along with relevant metadata (such as alert type, source, and timestamp) for the same row.
For users of other query languages
If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.
Usage
Syntax
Parameters
| Parameter | Description |
|---|---|
expression | The expression whose maximum value determines the selected record. |
field1, field2 | The additional fields to retrieve from the record with the maximum numeric value. |
Returns
Returns a row where the expression evaluates to the maximum value for each group (or the entire dataset if no grouping is specified), containing the fields specified in the query.
Use case examples
Find the slowest path for each HTTP method in the ['sample-http-logs'] dataset.
Query
Output
| uri | method | req_duration_ms |
|---|---|---|
| /home | GET | 1200 |
| /api/products | POST | 2500 |
This query identifies the slowest path for each HTTP method.
List of related aggregations
- arg_min: Retrieves the record with the minimum value for a numeric field.
- max: Retrieves the maximum value for a numeric field but does not return additional fields.
- percentile: Provides the value at a specific percentile of a numeric field.
Was this page helpful?