window

Description

Evaluates its argument in windowed context, partitioned over the given grouping and ordered by the given ordering (by default, input dataset timestamp.) Include ‘frame()’ to evaluate the window function inside a sliding window frame.

For queries, you may omit ‘frame()’ to use the current query time window, although this results in a dataset that cannot be accelerated.

Return type

any

Domain

This is a scalar function (calculates a single output value for a single input row.)

Categories

• Special

Usage

window( expr [ , group_by ] [ , order_by ] [ , frame ] )

Argument	Type	Required	Multiple
expr	any	Required	Only one
group_by	grouping	Optional	Only one
order_by	ordering	Optional	Only one
frame	frame	Optional	Only one

Examples

make_col name:window(first(name), group_by(section), order_by(time))

Name each row with the first name that appears in the current query time window

make_col avg:window(avg(load), group_by(host), order_by(time), frame(back:10m))

Compute the moving average of system load within the past 10 minutes of each event