Size distinct

[ 1 Description ] [ 2 How does it work in the search window? ] [ 3 How does it work in LINQ? ]

Description

This operation counts the size of different values in a given group.

How does it work in the search window?

Before being able to perform this operation, you have to group your data. Be aware that the fields used as arguments for the grouping operation will not be available to select as arguments for the aggregation operation.

After grouping the data, select Aggregate in the search window toolbar, then select the Size distinct operation. You need to specify one argument:

Argument	Data type

Argument	Data type
^mandatory	any

The data type of the aggregated values is integer.

Example

In the siem.logtrust.web.activity table, we want to calculate the average of the response length during each 5-minute period. Before aggregating the data, the table must be grouped in 5-minute intervals. Then we will perform the aggregation using the Size distinct operation.

The arguments needed for the Average operation are:

Size of → responseLength field

Click Aggregate to execute the operation.

How does it work in LINQ?

Group your data using the following structure:

group every server period by field1, field2...
every client period

Then, use select... as... to add the new field that will show the aggregated values. This is the syntax for the size distinct operation:

sizedistinct(numeric_field)

See Build a query using LINQ to learn more about grouping and aggregating your data using the LINQ language.

Example

You can copy the following LINQ script and try the above example on the siem.logtrust.web.activity table.

from siem.logtrust.web.activity
  group every 5m
  every 5m
  select sizedistinct(responseLength) as responseLength_sizedistinct