Enter a display name for the persisted aggregation. The name must be exclusive per repository (the same name used in different repositories is allowed). This field is required.

Enter a tag identifier for the filtered results. The tag can contain only alphanumeric characters and underscores. The tag must be unique per destination repository and cannot be reused until the persisted aggregation and its data are deleted. This field is required. The readPersistedAggregation() function uses this tag to identify the persisted aggregation, see readPersistedAggregation() Syntax Examples for examples on how the tag is used in querying.

Optionally, enter a description to document the purpose of the persisted aggregation.

Optionally, add labels to categorize and organize the persisted aggregation.

Select how often the aggregation should run and the time range it looks back over on each run. For example, an interval of 1 hour means the query runs every hour and each run covers the last hour of data, producing a new set of results each time. Available intervals are:

Select whether to aggregate based on ingest/timestamp (when events arrived in LogScale) or timestamp (event time from the log data). Use ingest/timestamp for more stable results with late-arriving events and to avoid ingest delay issues outside LogScale. Use timestamp when you need calculations based on when events actually occurred or when correlating events across sources to create a timeline.

Specify a delay in seconds to allow for late-arriving events. This setting applies only to timestamp queries, not ingest/timestamp queries. Higher values increase result accuracy at the cost of speed. Lower values return results faster but may miss late-arriving events. This delay does not affect interval boundaries.

Specify how many days, weeks, or months of historical data to backfill. Backfill calculates results as if the aggregation had been running from an earlier point in time. This runs once when the persisted aggregation is created. The backfill value cannot exceed the repository retention period. Leave empty to start from the current time.

Select whether the aggregation runs on behalf of an organization or on behalf of the user. Organization-level execution provides more stable permissions and does not depend on a specific user account. If you select user-level execution, the persisted aggregation stops running if the user is removed or loses permissions. Query prefixes applied to the user also apply to the persisted aggregation.