| transaction uno, programId, devicetype maxpause=15s
| eval s_time=_time | eval e_time=_time+duration
| eval watch_sec = e_time - s_time
| eval _time=s_time
| eval s_time = strftime(s_time, "%Y-%m-%d %H:%M:%S")
| eval e_time = strftime(e_time, "%Y-%m-%d %H:%M:%S")
| transaction uno, programId, devicetype
| eval s_time=_time | eval e_time=_time+duration
| eval watch_sec = e_time - s_time
| eval _time=s_time
| eval s_time = strftime(s_time, "%Y-%m-%d %H:%M:%S")
| eval e_time = strftime(e_time, "%Y-%m-%d %H:%M:%S")
When I use maxpause, events(00:00:00~00:06:50) are dropped.
I've changed it for 20 seconds, and then events(00:00:00~00:09:00) are dropped.
If there's any other way not to drop events, I want you to let me know.
Thx.
edit) I want to find time to use the program by user. There are about 400 million events a day, so I'm working on reducing these to about a million. I edited spl. Thx.
edit) My goal is
before)
00:00:00 ~ 00:59:57
01:00:03 ~ 01:59:58
02:00:02 ~ 02:30:00
04:30:00 ~ 04:59:56
05:00:01 ~ 05:30:00
21:30:00 ~ 21:59:55
22:00:04 ~ 22:30:00
after)
00:00:00 ~ 02:30:00
04:30:00 ~ 05:30:00
21:30:00 ~ 22:30:00
... View more