The array_sum function in APL computes the sum of all numerical elements in an array. This function is particularly useful when you want to aggregate numerical values stored in an array field, such as durations, counts, or measurements, across events or records. Use array_sum when your dataset includes array-type fields, and you need to quickly compute their total.
For users of other query languages
If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.
In Splunk SPL, you might need to use commands or functions such as mvsum for similar operations. In APL, array_sum provides a direct method to compute the sum of numerical arrays.
['dataset.name']
| extend total_duration = array_sum(duration_array)ANSI SQL doesn’t natively support array operations like summing array elements. However, you can achieve similar results with UNNEST and SUM. In APL, array_sum simplifies this by handling array summation directly.
['dataset.name']
| extend total_duration = array_sum(duration_array)Usage
Syntax
array_sum(array_expression)Parameters
| Parameter | Type | Description |
|---|---|---|
array_expression |
array | An array of numerical values to be summed. |
Returns
The function returns the sum of all numerical values in the array. If the array is empty or contains no numerical values, the result is null.
Use case example
Summing the duration of all events in an array field.
Query
['otel-demo-traces']
| summarize event_duration = make_list(duration) by ['service.name']
| extend total_event_duration = array_sum(event_duration)Output
| service.name | total_event_duration |
|---|---|
| frontend | 1667269530000 |
| checkoutservice | 3801404276900 |
The query calculates the total duration of all events for each service.
List of related functions
- array_rotate_right: Rotates array elements to the right by a specified number of positions.
- array_reverse: Reverses the order of array elements.
- array_shift_left: Shifts array elements one position to the left, moving the first element to the last position.