Hello,
I have logs with the following fields:
StartTime (which is used as _time)
Duration (in seconds)
The goal now is to count the number of events in the same timerange (_time + duration)
i.e.:
StartTime | Duration | EventNr
7/2/2015 8:45:00 AM | 3600 | 1
7/2/2015 8:50:00 AM | 600 | 2
7/2/2015 8:55:00 AM | 600 | 3
7/2/2015 9:10:00 AM | 1200 | 4
7/2/2015 10:00:00 AM | 1200 | 5
Range for Event #1 is from 8:45 to 9:45 -> 4 events in this timerange
Range for Event #2 is from 8:50 to 9:00 -> 2 events
...
Result should be a table:
EventNr | EventCount
1 | 4
2 | 2
...
Thanks,
Mathias
You can do this with the concurrency
command like this:
... | concurrency duration=Duration output=EventCount
Here is another very "expensive" way to do it but it will work:
... | eval StartTime=_time | eaval EndTime = _time + Duration | map search="search _time>=$StartTime$ AND _time<=$EndTime$ | stats count AS EventCount | eval EventNr=$EventNr$"]
You can do this with the concurrency
command like this:
... | concurrency duration=Duration output=EventCount
Here is another very "expensive" way to do it but it will work:
... | eval StartTime=_time | eaval EndTime = _time + Duration | map search="search _time>=$StartTime$ AND _time<=$EndTime$ | stats count AS EventCount | eval EventNr=$EventNr$"]
Pls using eventstats calculation.
How many rows that might be processed by the search? How many distinct EventNr can exists?
It's a csv with 3000 events and each event has it's distinct EventNr