Functions
This article provides an overview of aggregations and calculated fields.
Last updated
Was this helpful?
This article provides an overview of aggregations and calculated fields.
Last updated
Was this helpful?
Aggregations are functions for grouping multiple events together to form a more significant result, and they can return a single value or a hash table depending on the function.
Unlike databases, Upsolver runs continuous queries and not ad-hoc queries. Therefore, aggregation results are incrementally updated with every incoming event, and aggregation functions require windowing to split a stream into buckets of data that can be aggregated.
A calculated field is a field that wasn't part of an incoming event but is added into the event by using one of Upsolver's functions.
Examples:
extracting city from IP
running a regular expression
performing a mathematical operation