Skip to main content
The phrases aggregation extracts and counts common phrases or word sequences from text fields across a dataset. It analyzes text content to identify frequently occurring phrases, helping you discover patterns, trends, and common topics in your data. You can use this aggregation to identify common user queries, discover trending topics, extract key phrases from logs, or analyze conversation patterns in AI applications.

​
For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.
In Splunk SPL, there’s no built-in phrases function, but you might use the rare or top commands on tokenized text.
| rex field=message "(?<words>\w+)"
| top words
In ANSI SQL, you would need complex string manipulation and grouping to extract common phrases.
SELECT 
  phrase,
  COUNT(*) as frequency
FROM (
  SELECT UNNEST(SPLIT(message, ' ')) as phrase
  FROM logs
)
GROUP BY phrase
ORDER BY frequency DESC
LIMIT 10

​
Usage

​
Syntax

summarize phrases(column, max_phrases)

​
Parameters

NameTypeRequiredDescription
columnstringYesThe column containing text data from which to extract phrases.
max_phraseslongNoThe maximum number of top phrases to return. Default is 10.

​
Returns

Returns a dynamic array containing the most common phrases found in the specified column, ordered by frequency.

​
Example

Extract common phrases from GenAI conversation text to identify trending topics and patterns. Query 
['genai-traces']
| extend conversation_text = genai_concat_contents(['attributes.gen_ai.input.messages'], ' | ')
| summarize common_phrases = phrases(conversation_text, 20)
Output
Countcommon_phrases
3first query
3cover related future queries
3use title case
This query identifies the most common phrases in GenAI conversations, helping you discover trending topics and user needs.
  • make_list: Creates an array of all values. Use this when you need all occurrences rather than common phrases.
  • make_set: Creates an array of unique values. Use this for distinct values without frequency analysis.
  • topk: Returns top K values by a specific aggregation. Use this for numerical top values rather than phrase extraction.
  • count: Counts occurrences. Combine with group by for manual phrase counting if you need more control.
  • dcount: Counts distinct values. Use this to understand the variety of phrases before extracting top ones.