| transaction uno, programId, devicetype maxpause=15s
| eval s_time=_time | eval e_time=_time+duration
| eval watch_sec = e_time - s_time
| eval _time=s_time
| eval s_time = strftime(s_time, "%Y-%m-%d %H:%M:%S")
| eval e_time = strftime(e_time, "%Y-%m-%d %H:%M:%S")
| transaction uno, programId, devicetype
| eval s_time=_time | eval e_time=_time+duration
| eval watch_sec = e_time - s_time
| eval _time=s_time
| eval s_time = strftime(s_time, "%Y-%m-%d %H:%M:%S")
| eval e_time = strftime(e_time, "%Y-%m-%d %H:%M:%S")
When I use maxpause, events(00:00:00~00:06:50) are dropped.
I've changed it for 20 seconds, and then events(00:00:00~00:09:00) are dropped.
If there's any other way not to drop events, I want you to let me know.
Thx.
edit) I want to find time to use the program by user. There are about 400 million events a day, so I'm working on reducing these to about a million. I edited spl. Thx.
edit) My goal is
before)
00:00:00 ~ 00:59:57
01:00:03 ~ 01:59:58
02:00:02 ~ 02:30:00
04:30:00 ~ 04:59:56
05:00:01 ~ 05:30:00
21:30:00 ~ 21:59:55
22:00:04 ~ 22:30:00
after)
00:00:00 ~ 02:30:00
04:30:00 ~ 05:30:00
21:30:00 ~ 22:30:00
DO NOT USE transaction
! Try this:
index=<You should always specify an index> AND sourcetype=<And sourcetype too>
| streamstats current=f last(_time) AS next_time BY uno, programId, devicetype
| eval pause = next_time - _time
| streamstats count(eval(pause>15)) AS sessionID BY uno, programId, devicetype
| stats range(_time) AS duration list(_raw) AS _raw list(_time) AS time BY sessionID, uno, programId, devicetype
DO NOT USE transaction
! Try this:
index=<You should always specify an index> AND sourcetype=<And sourcetype too>
| streamstats current=f last(_time) AS next_time BY uno, programId, devicetype
| eval pause = next_time - _time
| streamstats count(eval(pause>15)) AS sessionID BY uno, programId, devicetype
| stats range(_time) AS duration list(_raw) AS _raw list(_time) AS time BY sessionID, uno, programId, devicetype
It works!!!
Thank you for your answering!!!!
@brook8128 please add more details for the community to assist you better. What is the data you are trying to correlate? what does your current SPL look like?