minif

This page explains how to use the minif aggregation function in APL.

Introduction

The minif aggregation in Axiom Processing Language (APL) allows you to calculate the minimum value of a numeric expression, but only for records that meet a specific condition. This aggregation is useful when you want to find the smallest value in a subset of data that satisfies a given predicate. For example, you can use minif to find the shortest request duration for successful HTTP requests, or the minimum span duration for a specific service in your OpenTelemetry traces.

The minif aggregation is especially useful in scenarios where you need conditional aggregations, such as log analysis, monitoring distributed systems, or examining security-related events.

For users of other query languages

If you come from other query languages, this section explains how to adjust your existing queries to achieve the same results in APL.

Splunk SPL users

In Splunk, you might use the min function in combination with where to filter results. In APL, the minif function combines both the filtering condition and the minimum calculation into one step.

ANSI SQL users

In ANSI SQL, you would typically use a CASE statement with MIN to apply conditional logic for aggregation. In APL, the minif function simplifies this by combining both the condition and the aggregation.

Usage

Syntax

summarize minif(Expression, Predicate)

Parameters

Parameter	Description
Expression	The numeric expression whose minimum value you want to find.
Predicate	The condition that determines which records to include.

Returns

The minif aggregation returns the minimum value of the specified Expression for the records that satisfy the Predicate.

Use case examples

• Log analysis
• OpenTelemetry traces
• Security logs

In log analysis, you might want to find the minimum request duration for successful HTTP requests.

Query

['sample-http-logs']
| summarize minif(req_duration_ms, status == '200') by ['geo.city']

Run in Playground

Output

geo.city	min_duration
San Diego	120
New York	95

This query finds the minimum request duration for HTTP requests with a 200 status code, grouped by city.

List of related aggregations

• maxif: Finds the maximum value of an expression that satisfies a condition. Use maxif when you need the maximum value under a condition, rather than the minimum.
• avgif: Calculates the average value of an expression that meets a specified condition. Useful when you want an average instead of a minimum.
• countif: Counts the number of records that satisfy a given condition. Use this for counting records rather than calculating a minimum.
• sumif: Sums the values of an expression for records that meet a condition. Helpful when you’re interested in the total rather than the minimum.