Skip to main content
Version: 6.1

Aggregation Rules

An aggregation rule differs from a declarative rule in how the threshold is evaluated. A declarative rule compares the threshold with the number of events that matched the condition. An aggregation rule compares it with an aggregate value calculated from the events in the window, such as a sum, average, or distinct count.

Correlation​

On the Correlation tab, define the window in which SMRTC collects data for aggregation:

  1. In Pre-filter, enter an expression in the SML (RTC) dialect. An event must match this expression to be included in the aggregation window
  2. Select Grouping Fields, which are field chips used to maintain a separate aggregate. A separate set of metrics is calculated and a separate firing is generated for each combination of these field values
  3. Set the Time Window using the Duration and Unit fields. This is the interval during which SMRTC accumulates events for metric calculation
  4. If necessary, enable Suppression Settings, and complete the Duration and Unit fields in the Suppression section that appears, as for a declarative rule. See Declarative Rules. After a firing, subsequent firings for the same group are suppressed for the specified period

Metrics​

In Metrics, configure one or more aggregates whose values determine whether the rule fires:

  1. Click Metric to add a metric section

  2. Enter a Name. The metric value is available under this name in Firing Condition and in the firing document

  3. Select a Function. The field offers functions in the following order:

    count, sum, min, max, avg, dc, values, median, p95, p99, variance, stddev, first, last, earliest, latest, rate

  4. Specify a Field, which is the event field used by the function. Field is optional only for count and rate. If it is specified for these functions, only events containing that field are included in the calculation

  5. If necessary, enter a Filter, which is a metric-specific event selection condition in the SML (RTC) dialect. If no filter is specified, the metric is calculated from all events that passed Pre-filter

Firing Condition​

In Firing Condition, enter an expression that uses metric names, for example, total >= 1000000000. It is evaluated after the window metrics have been calculated and determines whether a firing is generated.

The condition uses the metric namespace

Firing Condition is evaluated against the names specified in the Name field of each metric, not against event fields. The field mapping described in Rules does not apply to this condition.