Skip to content

sum

Sum aggregation operator. There are two variants of the :sum operator.

Aggregation

Input Stack:
query: Query
Output Stack:
AggregationFunction

Compute the sum of all the time series that match the query. Sum is the default aggregate function used if a query is specified with no explicit aggregate function.

Parameters

  • query: A query expression that selects the time series to aggregate

Examples

Example with implicit sum (:sum is applied automatically):

name,ssCpuUser,:eq

Equivalent example with explicit sum:

name,ssCpuUser,:eq,
:sum

When matching against the sample data in the table below, the highlighted time series would be included in the aggregate result:

Namenf.appnf.nodeData
ssCpuUser alerttest i-0123 [1.0, 2.0, NaN]
ssCpuSystem alerttest i-0123 [3.0, 4.0, 5.0]
ssCpuUser nccp i-0abc [8.0, 7.0, 6.0]
ssCpuSystem nccp i-0abc [6.0, 7.0, 8.0]
numRequests nccp i-0abc [1.0, 2.0, 4.0]
ssCpuUser api i-0456 [1.0, 2.0, 2.0]

The values from the corresponding intervals will be aggregated. For the first interval using the sample data above the values are 1.0, 8.0, and 1.0. Each value other than NaN contributes one to the sum. This leads to a final result of:

NameData
ssCpuUser [10.0, 11.0, 8.0]

The only tags for the aggregated result are those that are matched exactly (:eq clause) as part of the choosing criteria or are included in a group by.

Math

Input Stack:
expr: TimeSeriesExpr
Output Stack:
TimeSeriesExpr

Compute the sum of all the time series from the input expression. This variant is typically used when you need to apply a different aggregation function for grouping first, then sum the results.

Parameters

  • expr: A time series expression that may contain multiple series to sum

Examples

First group by cluster using max aggregation, then sum all the groups:

BeforeAfter
name,sps,:eq,
:max,
(,nf.cluster,),:by
name,sps,:eq,
:max,
(,nf.cluster,),:by,
:sum
  • :max - Maximum aggregation function
  • :min - Minimum aggregation function
  • :avg - Average aggregation function
  • :count - Count aggregation function
  • :by - Group time series by tag values before aggregating
  • :add - Mathematical addition of time series (different from aggregation)