Persisted Aggregations

Persisted aggregations allow you to define, schedule, and query aggregated metrics from log data. A persisted aggregation is a scheduled query that summarizes data from a source repository and writes results to a dedicated persisted aggregation repository. You can calculate metrics such as count, average, sum, and percentiles on a fixed schedule. Results are stored as events and can be queried directly, independently of the source data.

How Persisted Aggregations Work

The following diagram shows the workflow for creating and using persisted aggregations:

graph LR A[1. Source Repository<br/>with raw log data] --> B[2. Create Persisted Aggregation] B --> C[3. Configure PA Settings:<br/>- Aggregation query<br/>- Schedule interval<br/>- Output repository<br/>- Output tag] C --> D[4. PA runs on schedule<br/>writes to output repository] D --> E[5. Query with<br/>readPersistedAggregation function] E --> F[6. Display in Dashboards<br/>or use in queries] style A fill:#e1f5ff style D fill:#fff4e1 style F fill:#e8f5e9 click B "persisted-aggregation-create" "Create a persisted aggregation" click C "persisted-aggregation-configure" "Configure PA settings" click D "repositories-persisted-aggregation" "Output repository" click E "syntax-persisted-aggregations-querying" "Query persisted results" click F "dashboards-persisted-aggregations-create" "Use in dashboards"
graph LR A[1. Source Repository<br/>with raw log data] --> B[2. Create Persisted Aggregation] B --> C[3. Configure PA Settings:<br/>- Aggregation query<br/>- Schedule interval<br/>- Output repository<br/>- Output tag] C --> D[4. PA runs on schedule<br/>writes to output repository] D --> E[5. Query with<br/>readPersistedAggregation function] E --> F[6. Display in Dashboards<br/>or use in queries] style A fill:#e1f5ff style D fill:#fff4e1 style F fill:#e8f5e9 click B "persisted-aggregation-create" "Create a persisted aggregation" click C "persisted-aggregation-configure" "Configure PA settings" click D "repositories-persisted-aggregation" "Output repository" click E "syntax-persisted-aggregations-querying" "Query persisted results" click F "dashboards-persisted-aggregations-create" "Use in dashboards"

To set up and use persisted aggregations:

  1. Identify your source repository โ€” Start with a repository or view that contains the raw log data you want to aggregate. This is where your original events are stored.

  2. Create a persisted aggregation โ€” In the source repository, create a new persisted aggregation by defining an aggregation query that calculates metrics such as count, average, sum, and percentiles. See Create Persisted Aggregations for instructions and Supported Functions for supported functions.

  3. Configure the persisted aggregation โ€” Specify the schedule interval (every minute, hourly, daily, weekly, or yearly), output repository, and output tag. The output repository stores the aggregated results with the user-defined tag. Optionally configure historical backfill to retroactively calculate metrics as if the aggregation had been running from an earlier point in time. See Configure Persisted Aggregation Properties for configuration details and Persisted Aggregation Repositories for information about output repositories.

  4. Run the persisted aggregation โ€” The persisted aggregation executes automatically according to the configured interval, calculating metrics from your source data and writing results to the output repository.

  5. Query the aggregated results โ€” Use the readPersistedAggregation() function with CrowdStrike Query Language to retrieve the pre-computed results from the output repository instead of querying raw historical logs. You can run this query from any repository that has access to the output repository by specifying the output repository name in the view parameter. See Querying Persisted Aggregation Data for query syntax.

  6. Display results in dashboards โ€” Create dashboard widgets that use readPersistedAggregation() to display the aggregated metrics. Dashboard widgets populate quickly because they retrieve pre-computed results instead of running the aggregation live. See Optimize Dashboard Performance with Persisted Aggregations for examples.