Version: Next

dcount

dcount — count distinct input values

dcount(<any>) -> uint64

The dcount aggregation function uses hyperloglog to estimate distinct values of the input in a memory efficient manner.

Count of values in a simple sequence:

echo '1 2 2 3' | zq -z 'dcount(this)' -

3(uint64)

Continuous count of simple sequence:

echo '1 2 2 3' | zq -z 'yield dcount(this)' -

1(uint64)
2(uint64)
2(uint64)
3(uint64)

Mixed types are handled:

echo '1 "foo" 10.0.0.1' | zq -z 'yield dcount(this)' -

1(uint64)
2(uint64)
3(uint64)

The estimated result may become less accurate with more unique input values:

seq 10000 | zq -z 'dcount(this)' -

9987(uint64)

Count of values in buckets grouped by key:

echo '{a:1,k:1} {a:2,k:1} {a:3,k:2}' | zq -z 'dcount(a) by k | sort' -

{k:1,dcount:2(uint64)}
{k:2,dcount:1(uint64)}