Aggregate Functions
Compute a single numeric result — total, average, extremes, or count — across all matching records in one round-trip using the aggregate query type.
Query Shape
All aggregate queries share the same structure. Send a POST to /v1/agents/:id/query with "type": "aggregate" plus the function name and the field to operate on.
POST /v1/agents/:id/query
Authorization: Bearer spx_root_YOUR_ROOT_KEY
Content-Type: application/json
{
"type": "aggregate",
"fn": "sum | avg | min | max",
"field": "field_name",
"filter": { ... } // optional
}Response Shape
The response contains a single aggregate object with the function name, field, computed value, and the number of records that contributed to the result.
{
"aggregate": {
"fn_name": "avg",
"field": "amount",
"value": 247.50,
"record_count": 18
}
}| Key | Type | Description |
|---|---|---|
fn_name | string | The function that was applied (sum, avg, min, or max). |
field | string | The record field that was aggregated. |
value | number | null | The computed result. null when no matching records contained a numeric value for the field. |
record_count | integer | Number of records included in the computation (after any filter). |
sum — Total Value
Adds up all numeric values in field across matching records. Use this for revenue totals, byte counts, event counts with weights, and similar running totals.
{
"type": "aggregate",
"fn": "sum",
"field": "amount"
}curl -s -X POST http://localhost:7475/v1/agents/orders/query \
-H "Content-Type: application/json" \
-H "Authorization: Bearer spx_root_YOUR_ROOT_KEY" \
-d '{"type": "aggregate", "fn": "sum", "field": "amount"}' \
| python3 -m json.toolavg — Average Value
Returns the arithmetic mean of field across all matching records. Typical use cases include average order value, mean response latency, and average session length.
{
"type": "aggregate",
"fn": "avg",
"field": "amount"
}min — Smallest Value
Finds the smallest value of field across all matching records. Useful for finding the cheapest product in a category, the earliest login timestamp, or the lowest error rate recorded.
{
"type": "aggregate",
"fn": "min",
"field": "amount"
}max — Largest Value
Finds the largest value of field. Common uses: largest single order, peak concurrent users, highest recorded temperature.
{
"type": "aggregate",
"fn": "max",
"field": "amount"
}Counting records
Record counting is not part of the aggregate query type. Use the dedicated count query type instead — it accepts an optional filter and returns only the record count, with no payload transfer:
{ "type": "count" }{
"type": "count",
"filter": { "field": "plan", "op": "eq", "value": "pro" }
}{ "count": 42 }Filtering Aggregates
Add a filter object to scope the aggregate to a subset of records. The same filter syntax used in scan queries applies here.
{
"type": "aggregate",
"fn": "avg",
"field": "amount",
"filter": {
"field": "plan",
"op": "eq",
"value": "pro"
}
}{
"type": "aggregate",
"fn": "sum",
"field": "amount",
"filter": {
"AND": [
{ "field": "created_at", "op": "gte", "value": "2026-04-01" },
{ "field": "created_at", "op": "lt", "value": "2026-07-01" }
]
}
}Function Reference
| fn | Operates on | Returns | Typical use |
|---|---|---|---|
sum | numeric field | total | Revenue, bytes transferred, event weights |
avg | numeric field | mean | Average order value, mean latency |
min | numeric field | smallest | Lowest price, earliest timestamp |
max | numeric field | largest | Peak load, largest order, max score |
aggregate for a single number across the whole strand (total revenue, mean latency). Use group_by to count how many records share each unique field value (e.g. how many users are on each plan). See Group-By Queries.