Hi,
I have a fun one.... fun being the operative word 🙂 I have data that looks like the below when someone logs in. I've extracted out the exr value which is unique when a customer logs in. What I'd like to do is track the time duration between 1 login for a customer and the next.
example. customer with exr of exr395164 logs in at 1:10 pm does some things then logs out, then logs in again at 2:15 pm. I'd like to calculate the 1:05 min and then get an average of all customer times between logins.
Any things?
{ [-]
Properties: { [-]
args: [ [-]
{"accountId":"exr395164","customerId":"3555"}
]
category: Event
index: 1
}
analyticType: CustomAnalytic
buildTarget: blah
clientSessionId: DXFMTCJ-BGKVKYL
}
Use streamstats
.
your query that gets all the logins
| sort 0 _time
| bin _time as day span=1d
| streamstats current=f last(_time) as lasttime by customer day
| eval duration= _time - lasttime
Now you have your duration between logins. How to calculate the average depends on what you mean.
This is the average time between logins, averaged on a login basis.
| stats avg(duration) as duration
This is the average time between logins, averaged on a customer basis.
| stats avg(duration) as duration by customer
| stats avg(duration) as duration
Use streamstats
.
your query that gets all the logins
| sort 0 _time
| bin _time as day span=1d
| streamstats current=f last(_time) as lasttime by customer day
| eval duration= _time - lasttime
Now you have your duration between logins. How to calculate the average depends on what you mean.
This is the average time between logins, averaged on a login basis.
| stats avg(duration) as duration
This is the average time between logins, averaged on a customer basis.
| stats avg(duration) as duration by customer
| stats avg(duration) as duration
Hi DalJeanis,
That is pretty slick..... Now I can glue back the clumps of hair 🙂 One quick (hopefully) question..... the duration is in seconds?
@dbcase - yes, epoch time is in seconds, so subtracting two epoch times gives you an answer in seconds.
Thank you!!