The make_list aggregation function in Axiom Processing Language (APL) collects all values from a specified column into a dynamic array for each group of rows in a dataset. This aggregation is particularly useful when you want to consolidate multiple values from distinct rows into a single grouped result.

For example, if you have multiple log entries for a particular user, you can use make_list to gather all request URIs accessed by that user into a single list. You can also apply make_list to various contexts, such as trace aggregation, log analysis, or security monitoring, where collating related events into a compact form is needed.

Key uses of make_list:

  • Consolidating values from multiple rows into a list per group.
  • Summarizing activity (e.g., list all HTTP requests by a user).
  • Generating traces or timelines from distributed logs.

For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.

Usage

Syntax

make_list(column)

Parameters

  • column: The name of the column to collect into a list.

Returns

The make_list function returns a dynamic array that contains all values of the specified column for each group of rows.

Use case examples

In log analysis, make_list is useful for collecting all URIs a user has accessed in a session. This can help in identifying browsing patterns or tracking user activity.

Query

['sample-http-logs']
| summarize uris=make_list(uri) by id

Run in Playground

Output

iduris
user123[‘/home’, ‘/profile’, ‘/cart’]
user456[‘/search’, ‘/checkout’, ‘/pay’]

This query collects all URIs accessed by each user, providing a compact view of user activity in the logs.

  • make_set: Similar to make_list, but only unique values are collected in the set. Use make_set when duplicates aren’t relevant.
  • count: Returns the count of rows in each group. Use this instead of make_list when you’re interested in row totals rather than individual values.
  • max: Aggregates values by returning the maximum value from each group. Useful for numeric comparison across rows.
  • dcount: Returns the distinct count of values for each group. Use this when you need unique value counts instead of listing them.