make_set

This page explains how to use the make_set aggregation function in APL.

The make_set aggregation in APL (Axiom Processing Language) is used to collect unique values from a specific column into an array. It is useful when you want to reduce your data by grouping it and then retrieving all unique values for each group. This aggregation is valuable for tasks such as grouping logs, traces, or events by a common attribute and retrieving the unique values of a specific field for further analysis.

You can use make_set when you need to collect non-repeating values across rows within a group, such as finding all the unique HTTP methods in web server logs or unique trace IDs in telemetry data.

For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.

Splunk SPL users

In Splunk SPL, the values function is similar to make_set in APL. The main difference is that while values returns all non-null values, make_set specifically returns only unique values and stores them in an array.

ANSI SQL users

In ANSI SQL, the GROUP_CONCAT or ARRAY_AGG(DISTINCT) functions are commonly used to aggregate unique values in a column. make_set in APL works similarly by aggregating distinct values from a specific column into an array, but it offers better performance for large datasets.

Usage

Syntax

make_set(column, [limit])

Parameters

• column: The column from which unique values are aggregated.
• limit: (Optional) The maximum number of unique values to return. Defaults to 128 if not specified.

Returns

An array of unique values from the specified column.

Use case examples

• Log analysis
• OpenTelemetry traces
• Security logs

In this use case, you want to collect all unique HTTP methods used by each user in the log data.

Query

['sample-http-logs']
| summarize make_set(method) by id

Run in Playground

Output

id	make_set_method
user123	[‘GET’, ‘POST’]
user456	[‘GET’]

This query groups the log entries by id and returns all unique HTTP methods used by each user.

List of related aggregations

• make_list: Similar to make_set, but returns all values, including duplicates, in a list. Use make_list if you want to preserve duplicates.
• count: Counts the number of records in each group. Use count when you need the total count rather than the unique values.
• dcount: Returns the distinct count of values in a column. Use dcount when you need the number of unique values, rather than an array of them.
• max: Finds the maximum value in a group. Use max when you are interested in the largest value rather than collecting values.