frame¶
Description¶
Specify the approximate relative time frame for a window context.
The frame starts from the current row’s “Valid From” time minus “back”, and ends at “Valid From” plus “ahead” (both ends are inclusive). For better performance, the window frame boundaries may not be exact and can deviate by at most twice the resolution, where resolution is 1/120th of the total frame size or 10 seconds, whichever is larger. To make the window boundaries exact, at the cost of slower performance, use the frame_exact() function.
Frame can also take the parameters “start” or “end” which starts or ends the frame at a constant point in time for each row. “start” and “end” take timestamp types, and are restricted to being outside or on the boundary of the query window. “start” and “end” can only be used with the following window functions: sum, avg, count, min, max, and stddev. If “start” or “end” is specified, the query is non-accelerable.
The parameters “start” and “back” are mutually exclusive, and the parameters “end” and “ahead” are mutually exclusive. If neither “start” nor “back” are specified, “back” is set to 0. Similarly, if neither “end” nor “ahead” are specified, “end” is set to 0.
Return type¶
frame
Domain¶
This is a scalar function (calculates a single output value for a single input row.)
Categories¶
Usage¶
frame([ timePoint_1, timePoint_2, ... ])
Argument |
Type |
Optional |
Repeatable |
Restrictions |
|---|---|---|---|---|
timePoint |
expression |
yes |
yes |
none |
Examples¶
make_col avg:window(avg(load), group_by(host), order_by(time), frame(back:10m))
Compute the moving average of system load within the past 10 minutes of each event
make_col cumsum:window(sum(load), group_by(host), order_by(time), frame(start:query_start_time()))
Compute the cumulative sum of system load within the current query window.