Aggregating Results
Use the optional group by clause to group documents and retrieve aggregated stats. Separate each group definition from another with a comma. Unlike SQL, if you leave this control empty, the IQL web client places all documents into a single group and returns one row.
The following group definitions are available:
| Group Definition | Syntax | Examples |
|---|---|---|
| Simple grouping by field name | field | country |
| Limit the number of groups (top/bottom K). | field[number] field[bottom number by metric] |
country[5] returns the top 5 countries by count.country[bottom 5 by clicks] specifies the metric by which to order and uses the bottom countries instead of the top. |
| Group your data into buckets by ranges you define. The values for min, min2, max, max2, interval and interval2 are numbers. Multiple bucket statements are allowed. If you include all bucket definitions in one statement, the size of the buckets is automatically determined. Group your data into time buckets. The bucket size uses the same syntax as the relative values for the start and end values in the timerange filter. For example: Nd or Ndays. [Read more about relative values][timerange]. You can also specify the number of buckets as an absolute value. The time() call cannot be defined inside buckets(). |
buckets(metric, min, max, interval) buckets(metricX, min, max, interval metricY, min2, max2, interval2) time(bucketSize) time(Nb) |
buckets(accountbalance, 0, 100, 20)time(1h) groups data into buckets, each of which includes data from 1 hour.time(3b) groups data into 3 buckets, each of which includes data from one-third of the given time range. |
| IN construction for including more than one term. Using the IN construction in the group by clause is the same as using the IN construction in the where filter and then grouping by field name. | field in (term,term) field in ("term",term) field not in (term,term) |
country in (canada,us) country in ("great britain",deutschland) country not in (france,canada) |