Persisted Aggregations Syntax

Available: Persisted Aggregations Syntax v1.252.0

Persisted aggregations are available from version 1.252.

Persisted aggregations allow you to define, schedule, and query aggregated metrics from log data.

A persisted aggregation is a scheduled query that summarizes data from a source repository and writes results to a dedicated persisted aggregation repository. You can calculate metrics such as count, average, sum, and percentiles on a fixed schedule.

Because LogScale calculates and caches results in advance, queries run faster and consume fewer compute resources than real-time aggregations. Results are stored as events and can be queried directly, instead of querying raw historical logs.

Results are stored independently of the source repository, allowing you to retain aggregated data for longer periods at reduced storage costs. Persisted aggregations are well-suited for high-frequency analytic workloads where query speed and resource efficiency are priorities.

This section focuses on the query language syntax requirements and restrictions for persisted aggregations.

For information about creating and managing persisted aggregations through the user interface instead, see Persisted Aggregation Management. For information about tag requirements and constraints, see Configure Persisted Aggregation Properties. For detailed information about creating and configuring persisted aggregation repositories, see Persisted Aggregation Repositories.

Query Language Requirements

Persisted aggregation queries must follow these language requirements:

  • The query must contain at least one aggregator function.

  • Saved queries are not allowed.

  • Query parameters are not allowed.

  • Cartesian products are not allowed.

  • Field aliasing is not allowed.

  • Deprecated functions and arguments are not supported.

  • The query cannot reference other persisted aggregations.

Supported Functions

The following functions can be used in persisted aggregation queries.


Persisted Aggregation with Rollup Support

Available: Persisted Aggregation with Rollup Support v1.263.0

Persisted Aggregation with Rollup Support is available from version 1.263.

Persisted Aggregation with Rollup Support is a variant of persisted aggregations that stores aggregation state, allowing you to query results in larger time intervals than the schedule interval at read time (at a coarser time resolution).

It inherits all language requirements and supported functions from standard persisted aggregations, with the additional constraints described in the following sections.

Allowed First Aggregate Functions

The following functions are supported as the first aggregate in the query.

Table: Allowed first aggregate functions for Persisted Aggregation with Rollup Support

count() avg() sum() max()
min() stdDev() range() percentage()
selectFromMax() selectFromMin() selectLast() stats()

You can use additional aggregate functions after one of the allowed first aggregate functions.

Function Restrictions

Most functions allowed in normal persisted aggregations are also allowed in Persisted Aggregation with Rollup Support. The following functions have additional restrictions.

Table: Function restrictions for Persisted Aggregation with Rollup Support

Function Restriction Reason
percentile() Not allowed. Sketch-based approximation function.
top() Not allowed. Sketch-based approximation function.
asn() Allowed only before the first aggregator. External-dependency function.
cidr() Allowed only before the first aggregator. External-dependency function.
ioc:lookup() Allowed only before the first aggregator. External-dependency function.
ipLocation() Allowed only before the first aggregator. External-dependency function.
match() Allowed only before the first aggregator. External-dependency function.

Querying Persisted Aggregation Data

You query persisted aggregation results using CrowdStrike Query Language.

Because results are precomputed and stored as events in the destination repository, queries against persisted aggregation data run faster than equivalent queries against raw historical logs.

Each result event contains the following fields:

Table: Result event fields

Field Description
User-defined fields Fields produced by the aggregation query. For example, a query using groupBy([UserName], function=count(as=total)) produces events with UserName and total fields.
@timestamp Set to the interval start time.
@ingesttimestamp The time the result event was written to the persisted aggregation repository.
@pa_interval_start The start of the interval this result covers. Same value as @timestamp.
@pa_interval_end The end of the interval this result covers.

Each result event carries exactly one tag identifying the persisted aggregation that produced it. This tag is the value you defined at creation time. No other user-defined tags are written to result events.

The system reserves the @pa field prefix for metadata. Do not use this prefix when naming aggregation output fields.

To read persisted aggregation results programmatically, use the readPersistedAggregation() function. This function provides direct access to stored aggregation results with optional filtering by time range and grouping by a specified interval.