Edit Persisted Aggregations

You can edit existing persisted aggregations to adjust mutable configuration settings.

Note

When editing a persisted aggregation, some properties are immutable because they define the fundamental structure and identity of the aggregation's data. To use different values for these properties, you must create a new persisted aggregation. See the table “Persisted aggregation properties mutability” for details.

  1. Go to the Repository and Views page.

  2. Select a Persisted Aggregation repository.

  3. Go to the Automation tab and select Persisted aggregations.

  4. Click on a persisted aggregation row in the overview table (Figure 301, “Persisted aggregations overview”): the configuration panel opens.

  5. Optionally enable or disable the persisted aggregation using the toggle.

  6. Modify the Name of the persisted aggregation to edit.

  7. To edit the query, click Run on search page:

    Screenshot showing the Edit in search page button in the persisted aggregation configuration panel

    Figure 303. Edit persisted aggregation query


  8. Modify the query in the Search page.

  9. Click Save → Persisted aggregation to save the edited query as a new persisted aggregation.

The following table lists each persisted aggregation property and indicates whether you can modify it after creation.

Table: Persisted aggregation properties mutability

Property Mutability Description
Name Mutable Human-readable display name for organizing and identifying the persisted aggregation. Must be unique per view.
Tag Immutable User-defined identifier written to every result event. Constrained to alphanumeric characters and underscores. Must be unique per destination repository. Cannot be reused until the persisted aggregation and its data are deleted.
Aggregation query Immutable The aggregation query to execute. Must contain at least one aggregator.
Source repository Immutable The repository the query reads from.
Destination repository Immutable The persisted aggregation repository the results are written to. Must be a persisted aggregation repository type. Multiple persisted aggregations can write to the same repository.
Aggregation interval Immutable The interval determines both how often the aggregation runs and the time window being aggregated. Predefined values only.
Offset Mutable Delay applied to query execution to allow for late-arriving events. Only relevant for event time queries, not ingest time. Does not affect interval boundaries.
Interval anchor Immutable The anchor point for interval boundaries. For example, the 3rd hour of the day for daily intervals.
Query ownership Immutable Determines data visibility for the underlying query. Options are "On behalf of user" or "On behalf of organization". "On behalf of user" limits visibility to data the creating user has permission to see. "On behalf of organization" grants access to all organization data regardless of user-level permissions.
Labels Mutable User-defined labels for categorizing persisted aggregations on the list page. Labels are not written to result events.