Enter a display name for the persisted aggregation. The name must be exclusive per repository (the same name used in different repositories is allowed). This field is required.

Enter a tag identifier for the filtered results. The tag can contain only alphanumeric characters and underscores. The tag must be unique per destination repository and cannot be reused until the persisted aggregation and its data are deleted. This field is required. The readPersistedAggregation() function uses this tag to identify the persisted aggregation, see readPersistedAggregation() Syntax Examples for examples on how the tag is used in querying.

Optionally, enter a description to document the purpose of the persisted aggregation.

Optionally, add labels to categorize and organize the persisted aggregation.

Select how often the aggregation should run and the time range it looks back over on each run. For example, an interval of 1 hour means the query runs every hour and each run covers the last hour of data, producing a new set of results each time. Available intervals are:

Select whether to aggregate based on ingest/timestamp (when events arrived in LogScale) or timestamp (event time from the log data). Use ingest/timestamp for more stable results with late-arriving events and to avoid ingest delay issues outside LogScale. Use timestamp when you need calculations based on when events actually occurred or when correlating events across sources to create a timeline.

Specify a delay in seconds to allow for late-arriving events. This setting applies only to timestamp queries, not ingest/timestamp queries. Higher values increase result accuracy at the cost of speed. Lower values return results faster but may miss late-arriving events. This delay does not affect interval boundaries. This option is not available when rollup support is enabled.

Specify how many days, weeks, or months of historical data to backfill. Backfill calculates results as if the aggregation had been running from an earlier point in time. This runs once when the persisted aggregation is created. The backfill value cannot exceed the repository retention period. Leave empty to start from the current time.

Select this option to allow querying aggregated results at a larger time interval than the schedule interval at read time. This is particularly useful for persisted aggregations that store metrics. To use Rollup support:

The persisted aggregation returns results rolled up to the requested interval instead of the schedule interval.

The span value must be a positive integer multiple of the aggregation interval. For example, with a 1-minute aggregation interval, valid spans include 1m, 2m, 5m, and 1h, but not 1m30s. If you omit span at read time, it defaults to the aggregation interval. For query syntax requirements and function restrictions, see Persisted Aggregation with Rollup Support.

Offset is disabled when creating a persisted aggregation with Rollup support enabled.

Enabling rollup support cannot be reverted after creation.

Rollup support is available from version 1.263.

Select whether the aggregation runs on behalf of an organization or on behalf of the user. Organization-level execution provides more stable permissions and does not depend on a specific user account. If you select user-level execution, the persisted aggregation stops running if the user is removed or loses permissions. Query prefixes applied to the user also apply to the persisted aggregation.