sum

The sum aggregation in APL is used to compute the total sum of a specific numeric field in a dataset. This aggregation is useful when you want to find the cumulative value for a certain metric, such as the total duration of requests, total sales revenue, or any other numeric field that can be summed.

You can use the sum aggregation in a wide range of scenarios, such as analyzing log data, monitoring traces, or examining security logs. It is particularly helpful when you want to get a quick overview of your data in terms of totals or cumulative statistics.

​

For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.

​

Usage

​

Syntax

summarize [<new_column_name> =] sum(<numeric_field>)

​

Parameters

• <new_column_name>: (Optional) The name you want to assign to the resulting column that contains the sum.
• <numeric_field>: The field in your dataset that contains the numeric values you want to sum.

​

Returns

The sum aggregation returns a single row with the sum of the specified numeric field. If used with a by clause, it returns multiple rows with the sum per group.

​

Use case examples

• Log analysis
• OpenTelemetry traces
• Security logs

['sample-http-logs']
| summarize total_duration = sum(req_duration_ms)

​

List of related aggregations

• count: Counts the number of records in a dataset. Use count when you want to count the number of rows, not aggregate numeric values.
• avg: Computes the average value of a numeric field. Use avg when you need to find the mean instead of the total sum.
• min: Returns the minimum value of a numeric field. Use min when you’re interested in the lowest value.
• max: Returns the maximum value of a numeric field. Use max when you’re interested in the highest value.
• sumif: Sums a numeric field conditionally. Use sumif when you only want to sum values that meet a specific condition.