make_session

Type of operation: Aggregate, Metadata

Description

Group events or intervals that are close to each other into sessions, and calculate aggregations over each session. Two events or intervals would be assigned to the same session if the time period between them is below the session expiry time (default to one day). Two overlapped events or intervals will always be mapped to the same session. The output’s ‘valid_from’ and ‘valid_to’ fields would mark the start and end time of the session. Note that applying make_session over existing sessions may result in unexpected results. For instance, calculating average again over an already averaged column will not result in the correct average overall.

Note that the expiry calculation is slightly different between events or intervals input. For event input, two events are assigned to the same session if the difference between their timestamp is less than or equal to the expiry (e.g., when expiry is 1ns, only two overlapped or immediately adjacent events are assigned to the same session). For interval input, two intervals are assigned to the same session if the distance between them is less than the expiry (e.g., when expiry is 1ns, only two overlapped or “touching” intervals are assigned to the same session).

Usage

make_session [ options ] [ , groupby ] ..., groupOrAggregateFunction ...

Argument

Type

Required

Multiple

options

options

Optional

Only one

groupby

fieldref

Optional

Can be multiple

groupOrAggregateFunction

expression

Required

Can be multiple

Options

Option

Type

Meaning

expiry

duration

How long a session lasts after an observed state.

Accelerable

make_session is always accelerable if the input is accelerable. A dataset that only uses accelerable verbs, can be accelerated, making queries on the dataset respond faster.

Examples

make_session cnt:count(1), group_by(server_name)

Group input events or intervals into per server name sessions, and count the number of events or intervals in each session. Return a dataset with 4 columns ‘valid_from’, ‘valid_to’, ‘server_name’, and ‘cnt’.

make_session options(expiry:10m), cnt:count(1), group_by(server_name)

Similar to the above example, but expire each session after 10 minute’s inactivity (no new event falls into the session).

Aliases

  • makesession (deprecated)