dcountif

This page explains how to use the dcountif aggregation function in APL.

The dcountif aggregation function in Axiom Processing Language (APL) counts the distinct values in a column that meet a specific condition. This is useful when you want to filter records and count only the unique occurrences that satisfy a given criterion.

Use dcountif in scenarios where you need a distinct count but only for a subset of the data, such as counting unique users from a specific region, unique error codes for specific HTTP statuses, or distinct traces that match a particular service type.

For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.

Splunk SPL users

In Splunk SPL, counting distinct values conditionally is typically achieved using a combination of eval and dc in the stats function. APL simplifies this with the dcountif function, which handles both filtering and distinct counting in a single step.

ANSI SQL users

In ANSI SQL, conditional distinct counting can be done using a combination of COUNT(DISTINCT) and CASE. APL’s dcountif function provides a more concise and readable way to handle conditional distinct counting.

Usage

Syntax

dcountif(column_name, condition)

Parameters

• column_name: The name of the column for which you want to count distinct values.
• condition: A boolean expression that filters the records. Only records that meet the condition will be included in the distinct count.

Returns

The function returns the count of distinct values that meet the specified condition.

Use case examples

• Log analysis
• OpenTelemetry traces
• Security logs

In log analysis, you might want to count how many distinct users accessed the service and received a successful response (HTTP status 200).

Query

['sample-http-logs']
| summarize dcountif(id, status == '200')

Run in Playground

Output

distinct_successful_users
50

This query counts the distinct users (id field) who received a successful HTTP response (status 200), helping you understand how many unique users had successful requests.

List of related aggregations

• dcount: Counts distinct values without applying any condition. Use this when you need to count unique values across the entire dataset.
• countif: Counts records that match a specific condition, without focusing on distinct values. Use this when you need to count records based on a filter.
• dcountif: Use this function to get a distinct count for records that meet a condition. It combines both filtering and distinct counting.
• sumif: Sums values in a column for records that meet a condition. This is useful when you need to sum data points after filtering.
• avgif: Calculates the average value of a column for records that match a condition. Use this when you need to find the average based on a filter.