Can anyone please explain me the difference between sum and count aggregation with examples. I actually need to know number of hogging threads present in an application for a time interval of 30 min which we will specify in incident rule. Can you please tell me what aggregation should I use here.
Please find the attached screenshot. The measure we are using for hogging thread is that only. There is one aggregation in this measure and also we have to specify one more aggregation in the incident rule which we create by adding this measure. What is the difference between this two and also what exactly should we specify.
Sum is the sum of the numerical value that the measure is tracking, whereas count is the count of PurePaths the were involved when calculating that measure. So if your measure is for web requests and 2 PurePaths involved 4 web requests each, then the sum would be 8 and the count would be 2.
In your case I would recommend using the sum aggregation.