countof

The countof function counts the occurrences of a plain substring within a string. Use this function when you need to find how many times a specific text pattern appears in log messages, user input, or any string field without using regular expressions.

Usage

Syntax

countof(search, text)

Parameters

Returns

Returns the number of times the search string appears in the text.

Use case examples

['sample-http-logs']
| extend api_segments = countof('/', uri)
| summarize avg_depth = avg(api_segments), request_count = count() by method
| sort by request_count desc

['otel-demo-traces']
| extend has_http = countof('frontend', ['service.name'])
| summarize services_with_frontend = sum(has_http), total_spans = count()
| extend percentage = round(100.0 * services_with_frontend / total_spans, 2)

['sample-http-logs']
| extend slash_count = countof('/', uri)
| where slash_count > 5
| project _time, uri, slash_count, id, status, ['geo.country']
| sort by slash_count desc
| limit 10

List of related functions

• countof_regex: Counts substring occurrences using regular expressions. Use this when you need pattern matching instead of exact string matching.
• strlen: Returns the length of a string. Use this when you need the total character count rather than occurrence counting.
• indexof: Finds the position of the first occurrence of a substring. Use this when you need to know where a substring appears, not how many times.
• extract: Extracts substrings using regular expressions. Use this when you need to capture matched text rather than count occurrences.

Other query languages