Metrics Operators
The following table lists the metrics supported operators and provides examples of queries containing each type of operator.
Operator  Description and Syntax  Examples 


Converts each timeseries in the row to a series of running totals. The running total in each series starts from the value of the first data point in the series, then iteratively adds up successive values. For example, if RequestCount is { 2, 0, 4, 3, 0, 0 },



Calculates the average of all the resulting time series. If grouping is specified, it calculates the average for each group.


along 
For use when joining metric queries, results in the Sumo evaluating the summation expression by one or more metric fields. #A + #B along [FIELD (,FIELD, ...]] 
Given joined metric queries like this:metric=CPU_User _sourceHost=cqsplitter* The along operator causes the summation to be performed for time series whose _sourceHost value matches. 

Select the bottom specified time series sorted by the value of a mathematical expression evaluated over the query time range.
Supported aggregate functions: min, max, avg, count, sum, pct(n), latest 
Take the bottom 5 time series with the highest maximum value:


Counts the total number of time series that match the query. If grouping is specified, it counts the total number for each group.



Computes the backward difference at each data point in the time series to determine how much the metric has changed from its last value in the series. This operator also assigns the value of the delta 


Evaluates a time series based on a userspecified math expression.
where math expression is a valid math expression with Supported Basic operations: +, , *, / Supported Math functions: sin, cos, abs, log, round, ceil, floor, tan, exp, sqrt, min, max 

filter 
Filters a query to help reduce the number of series returned by applying a boolean test to some aggregate quantity.
Note that when you use 
Show only cpu metrics whose average over the time range queried is greater than 80% Show only cpu metrics where the min is greater than 20% and the max less than 50%


Calculates the maximum value of the time series that match the query. If grouping is specified, it calculates the maximum for each group.



Calculates the minimum value of the time series that match the query. If grouping is specified, it calculates the minimum for each group.



Parses the given field to create new fields to use in the metrics query. If no field is specified while parsing Graphite metrics, the metric name is used. Each wildcard in the pattern corresponds to a specified field. The parse operator supports both lazy (shortest match) and greedy (longest match) wildcard matches. Use '*' for a lazy match, or '**' for a greedy match.



Calculates the specified percentile of the metrics that match the query. If grouping is specified, it calculates the specified percentile for each group.



Segregates time series data by time period. This allows you to create aggregated results in buckets of fixed intervals (for example, 5minute intervals).
where ROLLUP is avg, min, max, sum or count. 


Computes a rate based on the forward difference at each time in the time series. The difference between the current and the next recorded value in a time series is scaled to a value per second. This operator also assigns the value of the rate 


Calculates the sum of the metrics values that match the query. If grouping is specified, it calculates the sum for each group.



Select the top specified time series sorted by the value of a mathematical expression evaluated over the query time range.
Supported aggregate functions: min, max, avg, count, sum, pct(n), latest 
Take the top 10 time series with the highest maximum value:
Reduce each time series by calculating (max / avg * 2) for it. Sort by this reduced value and take the top 10 values:


Shifts the time series from your metrics query by the specified amount of time. This can help when comparing a time series across multiple time periods.

