How count the event between start event and end event?

Follow

Chonghua Shen

• November 24, 2020 18:40

Hi talent,

My log looks like below in json format.

{"name": "start", "timestamp": 1605705758918, "sessionId": "session 1", "formType": "DDLTETRC", "formId": 11}

{"name": "processing", "timestamp": 1605705759818, "sessionId": "session 1"}

{"name": "start", "timestamp": 1605705758918, "sessionId": "session 2", "formType": "DDLTETRC", "formId": 22}

{"name": "processing", "timestamp": 1605705759918, "sessionId": "session 1"}

{"name": "processing", "timestamp": 1605705760018, "sessionId": "session 2"}

{"name": "end", "timestamp": 1605705765018, "sessionId": "session 1", "formType": "DDLTETRC", "formId": 11}

{"name": "end", "timestamp": 1605705767018, "sessionId": "session 2", "formType": "DDLTETRC", "formId": 22}

I want to count the number of processing event between start and end event as per session id, form type and form id. is it possible? do i need use save operator to store result in the middle way?

Thanks and best regards,

Flik

0

• 

  Rick Jury

  • November 24, 2020 20:48

  Hi flik you could try something like this:

  | json field=_raw "sessionId","formType","formId"
  | min(_messagetime) as start, max(_messagetime) as end, count as events by sessionid,formtype,formid
  | (end - start) / (1000 * 60 ) as duration_s

  0

  Comment actions Permalink

Please sign in to leave a comment.