Collect sorted
- Former user (Deleted)
- Mercedes Parrado Mejuto
Description
This operation collects a given grouping of floats into an sorted array.
How does it work in the search window?
Before being able to perform this operation, you have to group your data. Be aware that the columns used as arguments for the grouping operation will not be available to select as arguments for the aggregation operation.
After grouping the data, select Aggregate in the search window toolbar, then select the Collect sorted operation. You need to specify one argument:
Argument | Data type |
|---|---|
mandatory | float |
The data type of the aggregated values is array.
Example
In the siem.logtrust.web.activity table, we want to collect the response length during each 5-minute period into an array. Instead of the normal Collect operation, this time we want to sort the results in order. Before aggregating the data, the table must be grouped in 5-minute intervals. Then we will perform the aggregation using the collect operation.
The arguments needed for the collect distinct operation are:
collectsorted → responseLength field
Click Aggregate to execute the operation and see the following result:
How does it work in LINQ?
Group your data using the following structure:
group every server period by field1, field2...every client period
Then, use select... as... to add the new field that will show the aggregated values. This is the syntax for the collect distinct operation:
collectsorted(numeric_field)See Build a query using LINQ to learn more about grouping and aggregating your data using the LINQ language.
Example
You can copy the following LINQ script and try the above example on the siem.logtrust.web.activity table.
from siem.logtrust.web.activity
group every 5m
every 5m
select collectsorted(responseLength) as responseLength_