You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
* Description: The unit of the interval expression is the natural unit by default. **If the field is a date/time type field, the aggregation results always ignore null bucket**. And the interval is in date/time units, you will need to specify the unit in the interval expression. For example, to split the field ``age`` into buckets by 10 years, it looks like ``span(age, 10)``. And here is another example of time span, the span to split a ``timestamp`` field into hourly intervals, it looks like ``span(timestamp, 1h)``.
61
+
* Syntax: span([field_expr,] interval_expr)
62
+
* Description: The unit of the interval expression is the natural unit by default. If ``field_expr`` is omitted, span will use the implicit ``@timestamp`` field. An error will be thrown if this field doesn't exist. **If the field is a date/time type field, the aggregation results always ignore null bucket**. And the interval is in date/time units, you will need to specify the unit in the interval expression. For example, to split the field ``age`` into buckets by 10 years, it looks like ``span(age, 10)``. And here is another example of time span, the span to split a ``timestamp`` field into hourly intervals, it looks like ``span(timestamp, 1h)``.
63
63
* Available time unit:
64
64
65
65
+----------------------------+
@@ -580,7 +580,7 @@ Description
580
580
581
581
Version: 3.3.0 (Calcite engine only)
582
582
583
-
Usage: LIST(expr). Collects all values from the specified expression into an array. Values are converted to strings, nulls are filtered, and duplicates are preserved.
583
+
Usage: LIST(expr). Collects all values from the specified expression into an array. Values are converted to strings, nulls are filtered, and duplicates are preserved.
584
584
The function returns up to 100 values with no guaranteed ordering.
585
585
586
586
* expr: The field expression to collect values from.
@@ -977,3 +977,18 @@ PPL query::
977
977
| 1 | 2025-01-01 | 2 |
978
978
+-----+------------+--------+
979
979
980
+
981
+
Example 18: Calculate the count by the implicit @timestamp field
0 commit comments