> ## Documentation Index
> Fetch the complete documentation index at: https://axiom-mano-support-improvements.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Query data with Axiom

> Learn how to filter, manipulate, extend, and summarize your data.

The Query tab provides you with robust computation and processing power to get deeper insights into your data. It enables you to filter, manipulate, extend, and summarize your data.

To query your data, click the Query tab and choose one of the following options:

* [Generate a query using AI based on a natural-language prompt](#generate-query-using-ai)
* [Create a query using the visual query builder](#create-a-query-using-visual-query-builder)
* [Create a query using Axiom Processing Language (APL)](#create-a-query-using-apl)

You can easily switch between these methods at any point when creating the query.

## Generate query using AI

Explain what you want to infer from your data in your own words and Axiom AI generates the valid APL query for you.

1. Click the Query tab.
2. Click **APL**, and then click in the query editor.
3. Press <kbd>Cmd/Ctrl</kbd> <kbd>K</kbd>.
4. Type what you want to infer from your data in your own words using natural language, and then click **Generate**. For example, type `Show me the most common status responses in HTTP logs.`
5. Axiom’s AI generates the APL query based on your prompt and gives you the following options:
   * Click **Accept** to update the editor with the generated query and change the generated query before running it. Any previous input in the query editor is lost.
   * Click **Accept and run** to update the editor with the generated query and run it immediately. Any previous input in the query editor is lost.
   * Click **Reject** to go back to your previous input in the query editor and close the query generator.

### Iterate over prompt history

Axiom saves the prompts you type in the query generator. To find one of your previous prompts and generate an APL query for it:

1. Click the Query tab.
2. Click **APL**, and then click in the query editor.
3. Press <kbd>Cmd/Ctrl</kbd> <kbd>K</kbd>.
4. Cycle through your history using the arrow keys <Icon icon="arrow-up" iconType="solid" /> and <Icon icon="arrow-down" iconType="solid" /> to find the prompt.
5. Click **Generate**.

## Create query using visual query builder

1. In the top left, click **Builder**.
2. From the list, select the dataset that you want to query.
3. Optional: In the **Where** section, create filters to narrow down the query results.
4. Optional: In the **Summarize** section, select a way to visualize the query results.
5. Optional: In the **More** section, specify additional options such as sorting the results or limiting the number of displayed events.
6. Select the time range.
7. Click **Run**.

While the query runs, the status bar gives you continuous updates about the number of rows examined, matched, and returned.

See below for more information about each of these steps.

### Add filters

Use the **Where** section to filter the results to specific events. For example, to filter for events that originate in a specific geolocation like France.

To add a filter:

1. Click **+** in the **Where** section.
2. Select the field where you want to filter for values. For example, `geo.country`.
3. Select the logical operator of the filter. These are different for each field type. For example, you can use **starts-with** for string fields and **>=** for number fields. In this example, select `==` for an exact match.
4. Specify the value for which you want to filter. In this example, enter `France`.

When you run the query, the results only show events matching the criteria you specified for the filter.

[Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%22%5B'sample-http-logs'%5D%5Cn%7C%20where%20%5B'geo.country'%5D%20%3D~%20'France'%22%7D)

### Add multiple filters

You can add multiple filters and combine them with AND/OR operators. For example, to filter for events that originate in France or Germany.

To add and combine multiple filters:

1. Add a filter for France as explained in [Add filters](#add-filters).
2. Add a filter for Germany as explained in [Add filters](#add-filters).
3. Click **and** that appears between the two filters, and then select **or**.

The query results display events that originate in France or Germany.

[Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%22%5B'sample-http-logs'%5D%5Cn%7C%20where%20\(%5B'geo.country'%5D%20%3D~%20'France'%20or%20%5B'geo.country'%5D%20%3D~%20'Germany'\)%22%7D)

<Note>
  You can add groups of filters using the **New Group** element.
  Axiom supports AND/OR operators at the top level and one level deep.
</Note>

### Add visualizations

Axiom provides powerful visualizations that display the output of aggregate functions across your dataset. The **Summarize** section provides you with several ways to visualize the query results. For example, the `count` visualization displays the number of events matching your query over time. Some visualizations require an argument such as a field or other parameters.

[Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%22%5B'sample-http-logs'%5D%5Cn%7C%20summarize%20count\(\)%20by%20bin_auto\(_time\)%22%7D)

For more information about visualizations, see [Visualize data](/query-data/visualizations).

### Segment data

When visualizing data, segment data into specific groups to see more clearly how the data behaves. For example, to see how many events originate in each geolocation, select the `count` visualization and group by `geo.country`.

[Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%22%5B'sample-http-logs'%5D%5Cn%7C%20summarize%20count\(\)%20by%20bin_auto\(_time\)%2C%20%5B'geo.country'%5D%22%7D)

### More options

In the **More** section, specify the following additional options:

* By default, Axiom automatically chooses the best ordering for the query results. To specify the sorting order manually, click **Sort by**, and then select the field according to which you want to sort the results.
* To limit the number of events the query returns, click **Limit**, and then specify the maximum number of returned events.
* Specify whether to display or hide open intervals.

### Select time range

When you select the time range of a query, you specify the time interval where you want to look for events.

To select the time range, choose one of the following options:

1. In the top left, click <Icon icon="clock" iconType="regular" /> **Time range**.
2. Choose one of the following options:
   * Use the **Quick range** items to quickly select popular time ranges.
   * To the right of the **Start date** and **End date** fields, click <Icon icon="calendar-days" iconType="light" /> **Select date and time** to select specific times.
   * Enter the specific time in the **Start date** and **End date** fields using natural language. For example, `1 hour ago` or `last Monday at 3pm`. For more information on the supported natural language inputs, see the [Sugar documentation](https://sugarjs.com/docs/#/DateParsing). Don’t use the `from` and `after` keywords in your input.

## Create query using APL

APL is a data processing language that supports filtering, extending, and summarizing data. For more information, see [Introduction to APL](/apl/introduction).

Some APL queries are explained below. The pipe symbol `|` separates the operations as they flow from left to right, and top to bottom.

APL is case-sensitive for everything: dataset names, field names, operators, functions, etc.

Use double forward slashes (`//`) for comments.

### APL count operator

The below query returns the number of events from the `sample-http-logs` dataset.

```kusto theme={null}
['sample-http-logs']
| summarize count()
```

[Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%22%5B'sample-http-logs'%5D%5Cn%7C%20summarize%20count\(\)%22%7D)

### APL limit operator

The `limit` operator returns a random subset of rows from a dataset up to the specified number of rows. This query returns a thousand rows from `sample-http-logs` randomly chosen by APL.

```kusto theme={null}
['sample-http-logs']
| limit 1000
```

[Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%22%5B'sample-http-logs'%5D%5Cn%7C%20limit%201000%22%7D)

### APL summarize operator

The `summarize` operator produces a table that aggregates the content of the dataset. This query returns a chart of the `avg(req_duration_ms)`, and a table of `geo.city` and `avg(req_duration_ms)` of the `sample-http-logs` dataset from the time range of 2 days and time interval of 4 hours.

```kusto theme={null}
['sample-http-logs']
| where _time > ago(2d)
| summarize avg(req_duration_ms) by _time=bin(_time, 4h), ['geo.city']
```

[Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%22%5B'sample-http-logs'%5D%5Cn%7C%20where%20_time%20%3E%20ago\(2d\)%5Cn%7C%20summarize%20avg\(req_duration_ms\)%20by%20_time%3Dbin\(_time%2C%204h\)%2C%20%5B'geo.city'%5D%22%7D)

## Query results

The results view adapts to the query. This means that it adds and removes components as necessary to give you the best experience. The toolbar is always visible and gives details on the currently running or last-run query. The other components are explained below.

### Query results without visualizations

When you run a query on a dataset without specifying a visualization, Axiom displays a table with the raw query results.

#### View event details

To view the details for an event, click the event in the table.

To configure the event details view, select one of the following in the top right corner:

* Click <Icon icon="arrow-up" iconType="regular" /> **Navigate up** or <Icon icon="arrow-down" iconType="regular" /> **Navigate down** to display the details of the next or previous event.
* Click <img src="https://mintcdn.com/axiom-mano-support-improvements/RAnyhMNSzq9jLiuE/doc-assets/icons/fit-to-results.svg?fit=max&auto=format&n=RAnyhMNSzq9jLiuE&q=85&s=dd485e49c75324a96802baaa16b19339" className="inline-icon" alt="Fit panel to results icon" width="16" height="16" data-path="doc-assets/icons/fit-to-results.svg" /> **Fit panel to results** or <img src="https://mintcdn.com/axiom-mano-support-improvements/RAnyhMNSzq9jLiuE/doc-assets/icons/fit-to-viewport.svg?fit=max&auto=format&n=RAnyhMNSzq9jLiuE&q=85&s=47b6b218491af00790f89f95f8c3318c" className="inline-icon" alt="Fit panel to viewport height icon" width="16" height="16" data-path="doc-assets/icons/fit-to-viewport.svg" /> **Fit panel to viewport height** to change the height of the event details view.

In the event details view, click <Icon icon="ellipsis-vertical" iconType="solid" /> **More** for additional options:

* **View in context** opens the event in the stream of other events in the Stream tab.
* **Copy link to event**
* **Copy JSON**
* **Show nulls** or **Hide nulls** toggles whether to display fields with null values.

#### Select displayed fields

To select the fields to be highlighted or displayed in the table, click <Icon icon="sidebar-flip" iconType="light" /> **Toggle fields panel**, and then click the fields in the list.

Select <Icon icon="brackets-curly" iconType="regular" /> **Single column for event** to highlight the selected fields below the raw data for each event. Alternatively, select <Icon icon="table" iconType="light" /> **Column for each field** to display each selected field in a different column without showing the raw event data. In this view, you can resize the width of columns by dragging the borders.

Field visibility preferences are saved per user. There are no org-wide defaults for column layout.

#### Configure table options

To configure the table options, click <Icon icon="sliders-simple" iconType="light" />, and then select one of the following:

* Select **Fit columns** to automatically adjust the width of columns to fit the viewport.
* Select **Wrap lines** to keep the whole table within the viewport and avoid horizontal scrolling.
* Select **Show timestamp** to display the time field.
* Select **Show event** to display the raw event data in a single column and highlight the selected fields below the raw data for each event. Alternatively, clear **Show event** to display each selected field in a different column without showing the raw event data. In this view, you can resize the width of columns by dragging the borders.
* Select **Hide nulls** to hide empty data points.

#### Event timeline

Axiom can also display an event timeline about the distribution of events across the selected time range. In the event timeline, each bar represents the number of events matched within that specific time interval. Holding the pointer over a bar reveals a blue line marking the total events and shows when those events occurred in that particular time range. To display the event timeline, click <Icon icon="sliders-simple" iconType="light" />, and then click **Show chart**.

### Query results with visualizations

When you run a query with visualizations, Axiom displays all the visualizations that you add to the query. Hold the pointer over charts to get extra detail on each result set.

Below the charts, Axiom displays a table with the totals from each of the aggregate functions for the visualizations you specify.

If the query includes group-by clauses, there is a row for each group. Hold the pointer over a group row to highlight the group’s data on time series charts. Select the checkboxes on the left to display data only for the selected rows.

#### Configure chart options

Click <Icon icon="sliders-simple" iconType="light" /> to access the following options for each chart:

* In **Null values**, specify how to treat missing or undefined values.
* In **Variant**, specify the chart type. Select from area, bar, or line charts.
* In **Y-Axis**, specify the scale of the vertical axis. Select from linear or log scales.
* In **Annotations**, specify the types of annotations to display in the chart.

For more information on each option, see [Configure dashboard elements](/dashboard-elements/configure).

#### Merge charts

When you run a query that produces several visualizations, Axiom displays the charts separately. For example:

```kusto theme={null}
['sample-http-logs']
| summarize percentiles_array(req_duration_ms, 50, 90, 95) by status, bin_auto(_time)
```

[Run in Playground](https://play.axiom.co/axiom-play-qf1k/query?initForm=%7B%22apl%22%3A%22%5B'sample-http-logs'%5D%5Cn%7C%20summarize%20percentiles_array\(req_duration_ms%2C%2050%2C%2090%2C%2095\)%20by%20status%2C%20bin_auto\(_time\)%22%7D)

To merge the separately displayed charts into a single chart, click <Icon icon="sliders-simple" iconType="light" />, and then select **Merge charts**.

#### Compare time periods

On time series charts, holding the pointer over a specific time shows the same marker on similar charts for easy comparison.

When you run a query with a time series visualization, you can use the **Compare period** menu to select a historical time against which to compare the results of your time range. For example, to compare the last hour’s average response time to the same time yesterday, select `1 hr` in the time range menu, and then select `-1 day` from the **Compare period** menu. The dotted line represents results from the base date, and the totals table includes the comparative totals.

### Highlight time range

In the event timeline, line charts, and heat maps, you can drag the pointer over the chart to highlight a specific time range, and then choose one of the following:

* **Zoom** enlarges the section of the chart you highlighted.
* **Show events** displays events in the selected time range in the event details view.

The time range of your query automatically updates to match what you selected.

### Search within query results

To quickly search for an expression and highlight its occurrences within the query results:

1. In the query results view, press <kbd>Cmd/Ctrl</kbd> <kbd>F</kbd>.
2. Type the expression that you want to search for. Axiom automatically highlights the matches and jumps to the first match.
3. Press <kbd>Enter</kbd> repeatedly to go forward in the list of matches, and press <kbd>Enter</kbd> <kbd>Shift</kbd> to go backward.

Axiom’s search overrides the browser’s native search. Axiom’s search is more powerful because it highlights matching entries in all results returned by the query (while still respecting automatic limits). In contrast, the browser’s search can only highlight matching entries in the events rendered on your screen.

## Canvas

The Canvas tab lets you display multiple charts side by side for quick visual correlation and comparison. Instead of building a full dashboard, Canvas provides a lightweight, free-form workspace where you can add charts as you explore your data.

<Note>
  Canvas is designed for quick, ad-hoc analysis. To create a persistent dashboard with your charts, see [Create dashboards](/dashboards/create).

  Canvas is currently in public preview. For more information, see [Feature states](/platform-overview/roadmap#feature-states).
</Note>

### Add charts to Canvas

1. Click the Query tab.
2. Specify a query.
3. Press <kbd>Cmd/Ctrl</kbd> <kbd>Shift</kbd> <kbd>Enter</kbd>.

### Manage charts in Canvas

Each chart you add to Canvas appears as a separate chart that you can manage in the following ways:

* Drag and drop charts in Canvas to rearrange them.
* Use **Compare period** to see how data changes over time.
* Change chart type by clicking <Icon icon="chart-line" iconType="regular" /> **Change chart type**.
* Change chart options by clicking <Icon icon="ellipsis-vertical" iconType="regular" /> **More >** <Icon icon="gear" iconType="regular" /> **Chart options**.
* Add a chart to a dashboard by clicking <Icon icon="ellipsis-vertical" iconType="regular" /> **More > Add to dashboard** in the top bar.
* View the query for a chart by clicking <img src="https://mintcdn.com/axiom-mano-support-improvements/RAnyhMNSzq9jLiuE/doc-assets/icons/magnifying-glass-chart.svg?fit=max&auto=format&n=RAnyhMNSzq9jLiuE&q=85&s=2883267e3df8e148e6e1dfb88412a876" className="inline-icon" alt="Change chart type icon" width="16" height="16" data-path="doc-assets/icons/magnifying-glass-chart.svg" /> **View query**.
* Update the query for a chart by clicking the chart, editing the query in the query editor, and then clicking **Run**.
* Rename a chart by clicking <Icon icon="ellipsis-vertical" iconType="regular" /> **More >** <Icon icon="pencil" iconType="regular" /> **Rename**. Alternatively, click the name of the chart and type a new name.
* Duplicate a chart by clicking <Icon icon="ellipsis-vertical" iconType="regular" /> **More >** <Icon icon="copy" iconType="regular" /> **Duplicate**.
* Delete a chart by clicking <Icon icon="ellipsis-vertical" iconType="regular" /> **More >** <Icon icon="trash-can" iconType="regular" /> **Delete**.

### Share Canvas

Canvas state is stored in the URL. When you copy and share the URL, others can open the same Canvas with all its charts and queries. The same permissions apply as when sharing a dashboard. For more information, see [Share dashboards](/dashboards/configure#share-dashboards).

## Save and export query

You can save and export the query and its results to use them in other contexts.

### Save query

Save a query so that you and your team members can easily find it in the future. A saved query only includes the APL query itself, not the query results. Saved queries are automatically visible to all members of your Axiom organization. You can later [find saved queries](/query-data/datasets#saved-queries) in the Datasets tab.

### Create new saved query

1. Click **Save** in the top bar.
2. Axiom AI generates a descriptive name based on the query. Accept it or edit it to fit your needs.
3. Click **Save**.

### Replace previously saved query

1. Click **Save** in the top bar.
2. Click **Replace previously saved query**.
3. Select the existing saved query that you want to overwrite.
4. Click **Save**.

### Export query

To export a query and its results, click <Icon icon="ellipsis-vertical" iconType="solid" /> **More** in the top bar to access the following options:

* **Add to dashboard** lets you create dashboard elements based on the query and add them to a dashboard. For more information, see [Create dashboard elements](/dashboard-elements/create).
* **Create new monitor** lets you create a monitor based on the query. For more information, see [Monitors](/monitor-data/monitors).
* **Copy results** lets you copy the query results to your clipboard in JSON, CSV, TOON (structured), or TOON (list) format. TOON is a structured data format that's more efficient when sharing data with LLMs and other tools. Choose TOON (structured) for hierarchical data or TOON (list) for flat representations. For more information, see the [TOON documentation](https://github.com/toon-format/toon).
* **Download results** lets you download the query results in JSON, CSV, TOON (structured), or TOON (list) format. By default, Axiom exports up to 50 results. To export more results, add a [`limit` operator](/apl/tabular-operators/limit-operator) to your APL query before downloading. For example, `| limit 1000` returns up to 1,000 events. The maximum number of results you can export is 50,000.
* **Copy link with relative time** copies a link to the query where the time range is relative to the time when you open the link. For example, if the time range of the query is the last 30 minutes, using the link shows query results for the 30-minute time range before opening the link.
* **Copy link with absolute time** copies a link to the query where the time range is fixed to the same time range that you see in the query when you create the link. This link shows query results for the same time range, irrespective of when you open the link.