Create an event property
Every event includes fields for timestamp and actor. Other properties can be associated with the event as well, such as location, type of item purchased, or another attribute, column, or field that describes the event.
An event property can exist in your source data, in which case the Scuba UI identifies it as a raw event property. Or a user can define a custom event property, in which case it is identified as a manual event property. An event property produces a single value for each event.
Use an event property in a query to summarize, group by, or filter on a reusable expression.
For example, if your log data includes a start and end time, you can define a new event property using the calculate method, "duration", as end time minus start time. Then you can use "duration" in a more complicated query (in an aggregation, group by, or filter) or to construct another event property. When you then run the the top-level query, it computes duration for any event in your data that has both a start and end time.
Defining an event property
This section demonstrates how to create an event property, in which you specify a method.
You can specify one or more values for a filter or label event property, and optionally a value to assign if the event property definition does not return any results. To create a boolean segment, use Filter. To create a multivalued segment, use Label instead.
To create an event property that is a function, use the Calculate method. Specify the actor or context used to evaluate the value, as well as the mathematical operation to perform (add, subtract, multiply, or divide).
To create an event property, do the following:
From anywhere in the Scuba UI, select a dataset from the drop-down list in the top left corner. Your dataset options will be for your company data. In our example, we chose the financial dataset.
Click Data in the left navigation bar.
Click New Event Property in the top right corner of the window.
Enter a unique Name at the top of the window to describe the property. We named our example property Bought Stocks.
Next to Method, select the appropriate method for your property. In our example, we use Filter.
Select the appropriate options for the property from the drop-down lists. We chose events with action that matches stock_buy.
Optional: You can combine multiple actions or other event types in the same event property by clicking + or or in the filter definition. Or you can define multiple segments within the same event property by using the Label method instead of Filter. For example, we could call our event property Sold Stocks, and do one of the following:
Click + in the Filter method to combine stock_sell_short events and stock_sell events.
Or we could use the Label method and create distinct segments, one each for stock_sell events, stock_buy events, and stock_search events.
For both Filter and Label properties, it is good practice to name a bucket for any events that do not match the rules.
To validate your event property definition, click GO at the bottom left corner to run the query.
Click Save in the top right corner of the page. You can now use your event property as a building block in top-level queries.
More information
For more information and examples of event properties defined with other methods, see Building an event property in the User's Guide.
What's Next
You've successfully created an event property. Now you'll want to learn how to: