---
title: "Count (count)"
canonical: "https://docs.devo.com/space/latest/95192168/Count%20(count)"
format: markdown
---
> Macro (toc)

## Description

This operation calculates the total number of events for each grouping occurrence.

## How does it work in the search window?

You can use this operation in two different ways:

- If you use it with no arguments, it returns the number of events for each grouping occurrence.
- If you specify an argument, it returns the number of non-null values found in that column for each grouping occurrence.

> ⚠️ Before being able to perform this operation, you have to [group your data](https://devodocs.atlassian.net/wiki/spaces/latest/pages/95191181). Be aware that the columns used as arguments for the grouping operation will not be available to select as arguments for the aggregation operation.

After grouping the data, select **Aggregation **in the search window toolbar, then select the **Count** operation. As said before, this operation works both with and without arguments.

| **Argument** | **Data type** |
| --- | --- |
| **Count** | Any |

<span style="color: #282828">The data type of the aggregated values is </span>*integer*<span style="color: #282828">.</span>

### Example

<span style="color: #282828">In the</span><span style="color: #282828"> </span>`siem.logtrust.web.activity`<span style="color: #282828"> ta</span><span style="color: #282828">ble, we want to check the number of events in each 5-minute period and how many of them do not contain null IP addresses. Before aggregating the data, the table must be grouped in 5-minute intervals. </span><span style="color: #172b4d">Then we will perform two aggregations using the Count operation, one for the total number of events and one for those with a valid IP address.</span>

#### <span style="color: #282828">Count 1</span>

<span style="color: #282828">No arguments are needed for this first Count operation.</span>

![image](media://34dc052e-ade2-47b3-9e76-7016de6b82bd)

<span style="color: #000000">Click </span><span style="color: #000000">**Aggregate function**</span><span style="color: #000000"> and you will see the following result:</span>

![image](media://b8dbecb9-ad9b-4318-ba14-4aba20dc8eb6)

#### <span style="color: #282828">Count 2</span>

<span style="color: #282828">The arguments needed for this second Count operation are:</span>

- <span style="color: #000000">**Count**</span><span style="color: #000000"> →  </span><span style="color: #000000">**clientIpAddress**</span><span style="color: #000000"> column</span>

<span style="color: #000000">Click </span><span style="color: #000000">**Aggregate function**</span><span style="color: #000000"> and you will see the following result:</span>

## How does it work in LINQ?

Group your data using the following structure:

- `group every server period by column1, column2...`  
`every client period`

Then, use `select`... `as`...  to add the new column that will show the aggregated values. These are the valid syntaxes for the **Count** operation:

- `count()` →  Returns the number of events for each grouping occurrence.
- `count(column)` →  Returns the number of non-null values found in that column for each grouping occurrence.

See [Build a query using LINQ](https://devodocs.atlassian.net/wiki/spaces/latest/pages/95191261) to learn more about grouping and aggregating your data using the LINQ language.

### Examples

<span style="color: #282828">You can copy the following LINQ script and try the examples above on the </span>`demo.ecommerce.data`<span style="color: #282828"> table.</span>

##### **Count 1 (period total events)**

```
from demo.ecommerce.data
  group every 5m
  every 5m
  select count() as count
```

##### **Count 2 (field total events)**

```
from demo.ecommerce.data
  group every 5m
  every 5m
  select count() as count,
    count(clientIpAddress) as non_null_IP_addresses
```

##### Count 3 (group total events) 

In case you want to try another example with arguments when grouping, the following query shows the count of events for each **method-statusCode** unique occurrence every 10-minute period. In this case, no argument is specified in the **Count** operation.

```
from demo.ecommerce.data
  group every 10m by statusCode, method
  every 10m
  select count() as event_count
```

##### Count 4 (field unique values)

If you want to know the number of unique values in a field (or unique value combinations if there are several fields), you can use the `group select` command with the `count` operation after grouping with the field in question as the only grouping key.

```
from demo.ecommerce.data
group by statusCode
group select count()
```