NQL functions
Functions are predefined operations that aggregate datasets, enabling further analysis. They include operations like summing, averaging, and counting, often within grouped data. You can use aggregation functions with the compute
and summarize
clauses.
Syntax
Aggregated metrics
It's important to differentiate between functions and aggregated metrics. The data model contains various aggregated metrics simplifying access to information. They are defined as fields of the data model.
Smart aggregates
A smart aggregate is an aggregate on an aggregated metrics that abstracts the underlying computation. They are not fields of the data model. During the execution of a query, the parser computes them on the fly.
Example:
Retrieve a list of devices with less than 3GB of average free memory. The following query includes the free_memory.avg()
smart aggregate in a compute
clause. It computes the average free memory based on the same underlying data points as free_memory.avg
aggregated metrics. It is equivalent to free_memory.avg.avg().
Chaining of functions
You can call more than one function on the same field. Currently, the system supports chaining of the time_elapsed()
function.
Example:
The following query returns the list of devices with the time elapsed since their last fast startup.
In the following section you can find a list of all available functions with usage rules and examples.
Last updated