You can select any of the following aggregation options, depending on your business use case:

Average

Returns the average value of the specified property for the collected events.

Count

Returns the total number of collected events for the specified property.

Note:

• As a best practice, select only one count function. Multiple count functions consume processing power unnecessarily because only the last count value is evaluated.
• The Source field is not available for the count function.

Distinct Count

Returns the number of unique values of the specified property for the collected events. This function counts the NULL value as a unique value.

First

Returns the value of the first event in the window for the specified property.

Last

Returns the value of the last event in the window for the specified property.

Max

Returns the highest value of the specified property for the collected events.

Approximate Median

Returns the median value of the specified property for the collected events.

Note: The convergence speed is how fast the approximate median arrives at the closest point to the actual median value. For more information, see Approximate median calculation.

You define the convergence speed mode by clicking the Open icon to:

• Depends on value distribution – By default, the approximate median converges with the actual middle value a set speed every time a new event arrives at the window, depending on the value distribution.
• Custom speed – You can control the speed of convergence by entering a custom value, which must be a positive number. By using this mode, you can converge with the actual median faster or slower, depending on your business needs. If you increase the speed of convergence, the calculated approximate median might be less accurate. If you decrease the speed of convergence, the median might be more accurate, but it takes more time to converge.

Min

Returns the lowest value of the specified property for the collected events.

Sum

Adds the values of the specified property for the collected events and returns the sum.

Standard Deviation

Returns the standard deviation of the specified property for the collected events.

True if All

Returns TRUE when all values of the specified property are TRUE.

True if Any

Returns TRUE when at least one value of the specified property is TRUE.

True if None

Returns TRUE when all values of the specified property are FALSE.