In one embodiment, a device identifies a set of attributes from telemetry data generated by one or more agents regarding an online application accessible via a network. The device provides an interactive display to a user interface that includes options for a user to specify a selection of one or more attributes from the set of attributes and to specify an aggregation function. The device updates the interactive display to show a visualization of the aggregation function applied to the selection of one or more attributes and configures the one or more agents to collect only a subset of the telemetry data based on the selection of the one or more attributes and the aggregation function.