cube

Automatically performs all possible aggregations of the specified fields. The command returns an aggregated result containing all the possible combinations for the selected fields if multiple fields are specified in the by clause.

Syntax

cube [OPTIONS] AGGR_FUNC [as ALIAS], ... [by GRP_FIELD, ...]
Required Parameter
AGGR_FUNC [as ALIAS], ...
Pair of a aggretgational function (AGGR_FUNC) and optional alias (ALIAS) to be displayed as a field name. If no alias specified, the command uses the function name, such as avg(), as the field name. It is recommended that you specify an ALIAS.
Optional Parameter
label=FIELD
Label to be given to the aggregate value (default: null).
parallel=BOOL
Option to enable parallel processing (default: f).
  • t: Enables processing the query in parallel. The processing speed increases but the order of data is not guaranteed. Avoid using this option in query commands where the order of the data matters.
  • f: Disables processing the query in parallel.
by GRP_FIELD, ...
Grouping fields with by directive, separated by a comma(,). This option MUST follow after the AGGR_FUNC [as ALIAS] option.

Usage

  1. Retrieve records from web server log table web_access to calculate subtotals and grand totals of the count for all permutations of the date field and the status field.

    table web_access
    | eval date=string(date, "yyyy-MM-dd")
    | cube label="TOTAL_COUNT" count by date, status
    
  2. Calculate the aggregation of the count and size for all combinations generated by the values of the action and status fields.

    cube label=TOTAL count, sum(size) as size by action, status