Generating event streams including aggregated values from monitored netwrok data

An apparatus, comprising:

• one or more hardware processors;
• and
• memory storing instructions that, when executed by the one or more hardware processors, cause the apparatus to:
• cause display of a graphical user interface (GUI) including interface elements used to define an event stream to be generated by one or more remote capture agents from monitored network data, wherein the event stream is associated with a plurality of event stream attributes derived from the network data;
• receive input identifying:
• at least one first event stream attribute of the plurality of event stream attributes as a key attribute, wherein the at least one first event stream attribute is used to generate a respective key representing each event of the event stream, and
• at least one second event stream attribute of the plurality of event stream attributes as an aggregation attribute, wherein the at least one second event stream attribute is used to generate a respective aggregated value for each event of the event stream;
• and
• transmit, via a network, configuration information generated based on the received input to the one or more remote capture agents, the configuration information used by the one or more remote capture agents to generate the event stream, wherein each event of the event stream includes a key based on the at least one first event stream attribute and an aggregated value based on the second event stream attribute.

A non-transitory computer-readable storage medium storing instructions that when executed by a computer cause the computer to perform operations comprising:

• causing display of a graphical user interface (GUI) including interface elements used to define an event stream to be generated by one or more remote capture agents from monitored network data, wherein the event stream is associated with a plurality of event stream attributes derived from the network data;
• receiving input identifying:
• at least one first event stream attribute of the plurality of event stream attributes as a key attribute, wherein the at least one first event stream attribute is used to generate a respective key representing each event of the event stream, and
• at least one second event stream attribute of the plurality of event stream attributes as an aggregation attribute, wherein the at least one second event stream attribute is used to generate a respective aggregated value for each event of the event stream;
• and
• transmitting, via a network, configuration information generated based on the received input to the one or more remote capture agents, the configuration information used by the one or more remote capture agents to generate the event stream, wherein each event of the event stream includes a key based on the at least one first event stream attribute and an aggregated value based on the second event stream attribute.