Skip to main content

​
Overview

Slung supports five aggregation operations that process time-series data and return a single computed value.

​
Aggregation Operations

​
AVG - Average

Calculates the arithmetic mean of all matching data points. Syntax: 
AVG:series:[tags]:[range]
Example: 
AVG:cpu.total:[region=us-west AND NOT host=test]:[1700000000,1700000100]
Computes the average CPU usage for the specified region and time range, excluding test hosts. Implementation: Maintains a running sum and count, returning sum / count.

​
MIN - Minimum

Finds the smallest value among all matching data points. Syntax: 
MIN:series:[tags]:[range]
Example: 
MIN:series2:[tag3 OR tag4]:[start_time,end_time]
Returns the minimum value from data points tagged with either tag3 or tag4. Implementation: Initialized to positive infinity, updated with the smaller value on each comparison.

​
MAX - Maximum

Finds the largest value among all matching data points. Syntax: 
MAX:series:[tags]:[range]
Example: 
MAX:series3:[tag5 NOT tag6]:[start_time,end_time]
Returns the maximum value from data points that have tag5 but not tag6. Implementation: Initialized to negative infinity, updated with the larger value on each comparison.

​
SUM - Summation

Adds together all values from matching data points. Syntax: 
SUM:series:[tags]:[range]
Example: 
SUM:series4:[tag7]:[start_time,end_time]
Sums all values with the tag7 tag within the time range. Common Use Cases:
  • Total request counts
  • Total bytes transferred
  • Cumulative error counts
Example Without Time Range: 
SUM:s1:[enabled]
Sums all historical data for the s1 series where the enabled tag is present.

​
COUNT - Count

Counts the number of matching data points. Syntax: 
COUNT:series:[tags]:[range]
Example: 
COUNT:series5:[tag8]:[start_time,end_time]
Returns the number of data points with tag8 in the specified time range. Common Use Cases:
  • Number of requests
  • Event occurrences
  • Active instances

​
Omitting the Operation

The operation field is optional. When omitted, Slung defaults to SUM behavior internally, but you can use it to retrieve individual matching values instead of aggregated results.

​
Combining with Tag Filters

All aggregation operations support the full range of tag filtering capabilities: 
SUM:cpu.total:[env=prod AND host=h-9]
Sums CPU data only for production environment on host h-9. 
AVG:memory.used:[service=db OR NOT muted]
Averages memory usage for database services or any non-muted services.

​
Performance Considerations

  • COUNT is typically the fastest operation as it only increments a counter
  • MIN and MAX require a single comparison per data point
  • AVG and SUM involve arithmetic operations on each data point
  • Narrow your tag filters to reduce the number of data points processed
  • Use time ranges to limit the dataset when possible

Query Syntax

Full query DSL reference

Tags

Tag filtering operators

Build docs developers (and LLMs) love

Get started for freeTalk to us