Metric Expression Functions
Metric expressions support the functions listed in the following table. A function can return a time series or a scalar computed from a time series. Functions that return scalars must be used for heatmap charts.
Function  Returns Scalar?  Description 

avg(metric expression)

N  Computes a simple average for a time series. 
count_service_roles()

Y  Returns the number of roles. There are three variants of
this function:

dt(metric expression)

N  Derivative with negative values. The change of the
underlying metric expression per second. For example: dt(jvm_gc_count) . 
dt0(metric expression)

N  Derivative where negative values are skipped (useful for
dealing with counter resets). The change of the underlying metric expression per
second. For example: dt0(jvm_gc_time_ms) /
10 . 
getClusterFact(string factName, double
defaultValue)

Y  Retrieves a fact about a cluster. Currently supports one fact: numCores . If the number of cores cannot
be determined, defaultValue is
returned.

getHostFact(string factName, double
defaultValue)

Y  Retrieves a fact about a host. Currently supports one
fact: numCores . If the number of cores cannot be determined,
defaultValue is returned. For example,
The following query computes the percentage of total user and
system CPU usage each role is using on the host. It first computes the CPU seconds
per second for the number of cores used by taking the derivative of the total user
and system CPU times. It normalizes the result to the number of cores on the host by
using the
getHostFact function and
multiplies the result by 100 to get the
percentage.select dt0(total_cpu_user)/getHostFact(numCores,1)*100, dt0(total_cpu_system)/getHostFact(numCores,1)*100 where category=ROLE and clusterId=1 
greatest(metric expression, scalar metric expression)

N  Compares two metric expressions, one of which one is a
scalar metric expression. Returns a time series where each point is the result of
evaluating max(point, scalar metric
expression) . 
integral(metric expression)

N  Computes the integral value for a stream and returns a
timeseries stream within which each data point is the integral value of the
corresponding data point from the original stream. For example, select integral(maps_failed_rate) will
return the count of the failed number of maps. 
counter_delta(metric expression)

N  Computes the difference in counter value for a stream and
returns a timeseries stream within which each data point is the difference in counter
value of the corresponding data point from the counter value of previous data point in
the original stream. For example: select
counter_delta(maps_failed_rate) returns the count of the failed number of
maps. This method is more accurate than the integral() function. However there are a few caveats:

last(metric expression)

Y  Returns the last point of a time series. For example, to
use the last point of the cpu_percent
metric time series, use the expression select
last(cpu_percent) . 
least(metric expression, scalar metric expression)

N  Compares two metric expressions, of which one is a scalar
metric expression. Returns a time series where each point is the result of evaluating
min(point, scalar metric
expression) . 
max(metric expression)

Y  Computes the maximum value of the time series. For
example, select
max(cpu_percent) . 
min(metric expression)

Y  Computes the minimum value of the time series. 
moving_avg(metric expression,
time_window_sec)

N  Computes the moving average for a time series over a time
window time_window_sec specified in
seconds (2, 0.1, and so on) 
stats(metric expression, stats name)

N  Some timeseries streams have additional statistics for
each data point. These include rollup timeseries streams, crossentity aggregates,
and rate metrics. The following statistics are available for rollup and crossentity
aggregates: max, min, avg, std_dev, and sample. For rate metrics, the underlying
counter value is available using the "counter" statistics. For example, stats(fd_open_across_datanodes, max) or
stats(swap_out_rate,
counter) . 
sum(metric expression)

Y  Computes the sum value of the timeseries. 