Adding query aggregate calculations
A query can specify an aggregate calculation that computes a single value based on multiple events, such as the average of a series of numbers. The built-in aggregate functions are shown in the table below. For details about these functions, see
Built-in aggregate functions.
avg() | min() | last() | stddev() | prior() |
sum() | max() | wavg() | stddev2() | |
count() | first() | mean() | nth() | |
When a query does not specify an aggregate calculation or filter, only the most recent set of events that match the pattern are used to invoke the actions and any other procedural code. With an aggregate calculation or filter, every set of events, in the current set of events, that matches the pattern is available for use by the aggregate function, provided that the latest event is present in one of the sets of events. Any events or combinations of events that do not match the pattern or do not meet specified query conditions, are ignored; their values are not used by the aggregate function.
To add an aggregate calculation to a query:
1. In the Query Designer
Aggregates pane, click the down arrow next to the plus sign
and select
Calculation (select).
2. In the New Query Aggregate Calculation dialog, specify an expression that uses an aggregate function with identifiers from the pattern. You can also use parameters.
The first() and last() built-in aggregate functions process the oldest or newest event in the current set of events that the query is processing, respectively.
For example, the following aggregate calculation determines the average price of trades:
avg(trade1.price, trade1.amount)
3. The field at the bottom of the dialog displays the identifier for this calculation. You can change the identifier. You can refer to this identifier in a query action.
4. Click OK.
Query Designer displays the new aggregate calculation in a row in the Aggregates pane.
To modify the aggregate calculation, select it and then click the
Edit 
icon.
To remove the calculation, select it and then click the
Delete icon
.
Also, the new calculation is immediately added to the source code as a select clause in the find statement. If you modify the calculation in the Source tab, this is reflected in the Aggregates pane in the Design tab.
You can add one or more aggregate calculations as well as one or more aggregate filters. The order in which they appear in the Aggregates pane is the order in which they are executed in the query. To change the order, select an aggregate and click the up arrow or down arrow as needed.
When you add more than one aggregate filter to a query, then all of them must evaluate to true for the query actions to be invoked.