This article provides an overview of aggregations and calculated fields.
Aggregations are functions for grouping multiple events together to form a more significant result, and they can return a single value or a hash table depending on the function.
Unlike databases, Upsolver runs continuous queries and not ad-hoc queries. Therefore, aggregation results are incrementally updated with every incoming event, and aggregation functions require windowing to split a stream into buckets of data that can be aggregated.
A calculated field is a field that wasn't part of an incoming event but is added into the event by using one of Upsolver's functions.
- extracting city from IP
- running a regular expression
- performing a mathematical operation