ADQL Reference:
Overview
Functions are used as arguments in the SELECT clause. ADQL provides several types of functions as follows:
 Metric functions
 Bucketing functions
 Functions that modify other functions
The functions are described in the tables below. Many functions are only valid for numeric fields. Valid field types for each function are listed in the table.
Note: In the Controller Analytics search UI, the query box in the data tab is used for adding WHERE clause differentiation. When you perform the search, the results of metric functions are shown in the visualization tab under the table widget.
Metric Functions
Metric functions perform a calculation on a set of values for a field and return a result, such as a count or a sum or a set of results, such as percentile. Metric functions can only be in the SELECT clause. A metric function should always be preceded by a field_name unless it is the only field. If the fields in the query are not in this order, some visualizations do not work.
Function  Description  Valid Field Type  ADQL Query Examples 

avg(numeric_field_name)  Returns the average value for a numeric field.  integer or floating point  SELECT 
count(field_name)  Returns a count of events. Only one field can be specified. Can be used to find data such as the top 10 IP addresses hitting an application.  all  SELECT The following query returns the top 10 ip addresses hitting an application. SELECT ip, 
distinctcount(field_name)  Returns a count of the number of unique values recorded for a field. This function returns accurate results up to 3000 unique values, beyond that value the results are approximate due to performance optimizations. Note: The maximum accuracy is reduced if the function is used following a bucketing function or group by term.  all  SELECT 
max(numeric_field_name)  Returns the maximum recorded value of a numeric field. Only one field can be specified.  integer, floating point  SELECT 
min(numeric_field_name)  Returns the minimum recorded value of a numeric field. Only one field can be specified.  integer, floating point  SELECT 
stdev(numeric_field_name)  Returns the population standard deviation of a numeric field. This value cannot be used to sort or filter results  integer, floating point  SELECT stdev (numeric_field_name)FROM transactions 
sum(numeric_field_name)  Returns the sum of the values of a numeric field. Only one field can be specified.  integer, floating point  SELECT 
percentile(numeric_field_name, percent)  Returns the specified percentile values. Multiple percentiles can be specified. The percentile must be between 0 and 100.  integer, floating point  SELECT 
stats(numeric_field_name)  Returns statistics for a field, including count, min, max, average, sum.  integer, floating point  SELECT 
Bucketing Functions
Function  Description  Valid Field Type  ADQL Query Examples 

range (field_name, n, (n1, n2), (n4, n5) and so on)  This bucketing function returns aggregations bucketed into ranges. The parameters can be a single value, x, or pairs of values "x,y". Pairs of values (x, y) define an explicit bucket from x, inclusive, to y, exclusive. Single values x define a range from the previous argument if it is also a single value, inclusive, to x, exclusive. A single value appearing immediately after the field defines a bucket starting at negative infinity, a single value at the end of the parameter list defines a bucket ending at positive infinity. A single value surrounded on both sides by pairs of values is ignored.  integer, floating point, and dates  This range query: SELECT Results in the following buckets: [Inf, 0), [10, 20), [40, 50), [60, 70), [70, +Inf) 
series(field_name, interval_size)  This bucketing function generates a series of buckets based on the provided interval. If there are no values in a specific bucket, it is omitted from the results. Date units up to weeks are supported. For date fields, use intervals such as:
For numeric fields, specify the interval as an integer. Use the time range selector in the upper right to get a larger data set in your results. The series function operates also with extended bounds. Extended bound forces the histogram aggregation to start building intervals from a specific minimum value and expands the interval up to a given maximum value. The series function operates with the interval value alone as well as with both the interval value and the extended bounds. Extended bounds argument does not operate as a filtering bucket. If the minimum value of extended bounds is higher than the values extracted from the events, the events will still dictate what the first bucket is. This rule also applies to the maximum value of extended bounds and the last bucket. Series supports the following keyword arguments:
 integer, floating point, and dates  SELECT SELECT
SELECT SELECT SELECT SELECT 
Functions That Modify Other Functions
Function  Description  ADQL Query Examples 

filter(metric_function (field_expression), ...) [WHERE] condition_expression)  This function applies a filter to the input of a single metric function and enables computation of aggregations for specific subsets of data. The metric function must be one of the following that returns a single value. { The second argument has the same syntax as a WHERE clause and optionally begins with the WHERE keyword, such as: SELECT filter(  filter( SELECT 100.0 * filter(
