What is a journal?

A journal is a temporal view of a query whereby the results of a query are grouped into fixed time periods (such as every minute, hour or day etc).

A journal can be used to calculate aggregates and/or detect anomalous conditions for message data in real-time.

For example, a journal could be used to:

• Count the number of messages acquired each hour.
• Insert an alert row for each message that matches given criteria.
• Count the number of messages with a measure that exceeds a given threshold during each day

Note that the query results of a journal are materialised so that the results of a journal can be retained independently of the underlying source data - hence tables and journals are purged independently.