Use STATS ... BY to group rows according to a common value and calculate one or more aggregated values over the grouped rows.

FROM employees
| STATS count = COUNT(emp_no) BY languages
| SORT languages

If BY is omitted, the output table contains exactly one row with the aggregations applied over the entire dataset:

FROM employees
| STATS avg_lang = AVG(languages)

It’s possible to calculate multiple values:

FROM employees
| STATS avg_lang = AVG(languages), max_lang = MAX(languages)

It’s also possible to group by multiple values (only supported for long and keyword family fields):

FROM employees
| EVAL hired = DATE_FORMAT(hire_date, "YYYY")
| STATS avg_salary = AVG(salary) BY hired, languages.long
| EVAL avg_salary = ROUND(avg_salary)
| SORT hired, languages.long

The following aggregation functions are supported: