Aggregation Rule Metrics

To view the progress of aggregation computation, run the Aggregation Rule Metrics query in Advanced Search.

Query

USE Loglogic_Aggregation_Rules_Metrics

Description

When a new aggregation rule is created, it starts computing the metrics for the given GROUP BY expressions. It aggregates data for all events received in the system after rule start time and the data for the past events specified in the Compute aggregation for field. To view the progress of the aggregation computation, you can run this infrastructure query in the Advanced Search.

Query Result

The following fields are returned in the search results:

Field Description
aggregationRuleName The name of the aggregation rule
totalEventCount The number of events processed by the aggregation rule
successCount The number of valid events computed by the aggregation rule query
errorCount The number of events that failed to validate by the aggregation rule query
savedRecordCount The number of records stored in the database for the aggregation rule
dataSizeInMB The size of saved records in megabytes (MB)
replayProgress The number of events processed out of the total events for historical computation (the aggregation computed prior to rule creation)

Applicable only if the aggregation start time is specified in the Compute aggregation for field.

replayPercentage Percentage progress of the historical computation
isMerged Indicates (Yes or No) if the historical computation results are merged in the database with the ongoing, real-time computation results