| Table of Contents | ||||
|---|---|---|---|---|
|
...
Argument | Data type |
|---|---|
Count | Any |
The data type of the aggregated values is integer.
Example
In the siem.logtrust.web.activity table, we want to check the number of events in each 5-minute period and how many of them do not contain null IP addresses. Before aggregating the data, the table must be grouped in 5-minute intervals. Then we will perform two aggregations using the Count operation, one for the total number of events and one for those with a valid IP address.
Count 1
No arguments are needed for this first Count operation.
...
Click Aggregate function and you will see the following result:
...
Count 2
The arguments needed for this second Count operation are:
Count → clientIpAddress column
...
See Build a query using LINQ to learn more about grouping and aggregating your data using the LINQ language.
Examples
You can copy the following LINQ script and try the examples above on the demo.ecommerce.data table.
Count 1 (period total events)
...
If you want to know the number of unique values in a field (or unique value combinations if there are several fields), you can use the group select command with the count operation after grouping with the field in question as the only grouping key.
...