make_session

Type of operation: Aggregate, Metadata

Description

Group events or intervals that are close to each other into sessions, and calculate aggregations over each session.

Two events or intervals would be assigned to the same session if the time period between them is below the session expiry time (default to one day). Two overlapped events or intervals will always be mapped to the same session. The output’s ‘valid_from’ and ‘valid_to’ fields would mark the start and end time of the session.

If groupby is not specified, the default grouping will be used. The default grouping for make_session is the set of primary key columns.

Note that applying make_session over existing sessions may result in unexpected results. For instance, calculating average again over an already averaged column will not result in the correct average overall.

Note that the expiry calculation is slightly different between events or intervals input. For event input, two events are assigned to the same session if the difference between their timestamp is less than or equal to the expiry (e.g., when expiry is 1ns, only two overlapped or immediately adjacent events are assigned to the same session). For interval input, two intervals are assigned to the same session if the distance between them is less than the expiry (e.g., when expiry is 1ns, only two overlapped or “touching” intervals are assigned to the same session).

Usage

make_session [ options ], [ groupby_1, groupby_2, ... ], groupOrAggregateFunction_1, groupOrAggregateFunction_2, ...

Argument	Type	Optional	Repeatable	Restrictions
options	options	yes	no	constant
groupby	variant	yes	yes	column
groupOrAggregateFunction	expression	no	yes	none

Options

Option	Type	Meaning
expiry	duration	How long a session lasts after an observed state.

Accelerable

make_session is always accelerable if the input is accelerable. A dataset that only uses accelerable verbs can be accelerated, making queries on the dataset respond faster.

Examples

make_session cnt:count(1), group_by(server_name)

Group input events or intervals into per server name sessions, and count the number of events or intervals in each session. Return a dataset with 4 columns ‘valid_from’, ‘valid_to’, ‘server_name’, and ‘cnt’.

make_session options(expiry:10m), cnt:count(1), group_by(server_name)

Similar to the above example, but expire each session after 10 minute’s inactivity (no new event falls into the session).

Aliases

• makesession (deprecated)