---
title: Configure an aggregation for source data
description: To analyze the performance of a specific facet in a business process that is recorded in a ServiceNow table, create an aggregation specific to the facet and create a report for this aggregation.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/vulnerability-response/configure-indicator-for-source-data.html
release: australia
product: Vulnerability Response
classification: vulnerability-response
topic_type: task
last_updated: "2026-03-12"
reading_time_minutes: 3
breadcrumb: [Aggregated reports framework, Analytics and Reporting Solutions for Vulnerability Response, Vulnerability Response, Unified Security Exposure Management, Security Operations]
---

# Configure an aggregation for source data

To analyze the performance of a specific facet in a business process that is recorded in a ServiceNow table, create an aggregation specific to the facet and create a report for this aggregation.

## Before you begin

Role required: sn\_vul\_cmn.admin

## Procedure

1.  Navigate to **All** > **Aggregated Reports** > **Aggregation definitions** > **All** and click **New**.

2.  In the **Name** field, give the aggregation a descriptive name.

3.  In the **Description** field, provide a brief description about the aggregation.

4.  In the **Source** tab, fill in the fields.

<table id="table_dgn_rwk_lvb"><thead><tr><th>

Field

</th><th>

Description

</th></tr></thead><tbody><tr><td>

Table

</td><td>

Table from which you want to fetch the data for the report. This drop-down contains app sec common, app-vul, app-vulc, app-vul-container, and application vulnerability tables only.

</td></tr><tr><td>

Aggregate function

</td><td>

Function to be applied to the column selected in **Field**.-   **Count**: Number of records.
-   **Sum**: Total sum of the values in the column selected in **Field**.
-   **Average**: Average of all the values in a column selected in **Field**.
-   **Maximum**: Maximum value in the column selected in **Field**.
-   **Minimum**: Minimum value of the column selected in **Field**.
-   **Count Distinct**: Unique values in the column selected in **Field**.


</td></tr><tr><td>

Field

</td><td>

Column on which you want to apply the function.**Note:** This field doesn't appear when you select **Count** in the **Aggregate function** field.

</td></tr></tbody>
</table>5.  In the **Additional Conditions** tab, provide the condition in the **Conditions** field to select a particular set of records for which you want to get the aggregated results.

6.  In the **Group By** tab, select the columns of the table by which you want to group or stack the data.

    You can select up to two breakdowns.

    If you select the **date** column in any group by field, the **Trend by** field appears. You can get the aggregation results that are categorized by week, day, minutes, etc by selecting the options in the **Trend by** field.

7.  In the **Schedule** tab, select or create an aggregation schedule, which defines the frequency at which you can execute the aggregation to fetch the data.

    To create an aggregation schedule, see [Run multiple aggregations simultaneously](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/run-multiple-aggregations.md).

    **Note:** You cannot schedule the aggregation run for an inactive aggregation definition.

8.  Click **Submit** to create the aggregation.

    The aggregation appears in the Aggregation list. At the predefined frequency, the aggregation is executed, and a record is created along with an execution date and time in the Scheduled Runs related list for every execution.

9.  Navigate to **All** &gt; **Aggregated Results** and open your aggregation to see the Aggregated Results and Scheduled Runs.

    The aggregated results are listed in the **Aggregated Results** related list. If the aggregation run fails, see the **Notes** column in the **Scheduled Runs** related list for more information.

10. Select **Execute Now** to collect the aggregation results irrespective of the aggregation schedule.

    If you terminate the scheduled run when it is in progress, then no changes are made to the aggregated results. You can also delete or deactivate an aggregation.


## What to do next

Create a report using your aggregation. For more information about creating a report using an aggregation, see [Create a report using an aggregation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/generate-report.md).

**Related topics**  


[Aggregated reports framework](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/vulnerability-response-common-content-pack.md)

[Run multiple aggregations simultaneously](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/run-multiple-aggregations.md)

[Configure the number of aggregations that can run simultaneously](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/create-config-arf-processor.md)

[Create a report using an aggregation](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/vulnerability-response/generate-report.md)