In EQL, aggregation operations bucket a set of records into a
resulting set of aggregated records.
GROUP/GROUP BY clauses
The GROUP and GROUP BY clauses specify how to map source records to result records in order to group statement output.
GROUPING SETS expression
A GROUPING SETS expression allows you to selectively specify the set of groups that you want to create within a GROUP BY clause.
ROLLUP extension ROLLUP is an extension to GROUP BY that enables calculation of multiple levels of subtotals across a specified group of attributes. It also calculates a grand total.
CUBE extension CUBE takes a specified set of attributes and creates subtotals for all of their possible combinations.
Grouping sets helper functions
There are three helping functions that you can use for queries that use grouping capabilities.
Notes on grouping behavior
This topic describes some EQL grouping behaviors that you should be aware of.
COUNT and COUNTDISTINCT functions
The COUNT function returns the number of records that have a value for an attribute. COUNTDISTINCT counts the number of distinct values for an attribute.
Per-aggregation filters
Each aggregation can have its own filtering WHERE clause. Aggregation function filters filter the inputs to an aggregation expression. They are useful for working with sparse or heterogeneous data. Only records that satisfy the filter contribute to the calculation of the aggregation function.