timechart

Type of operation: Aggregate

Description

Bin (in time) and aggregate point or interval table columns through time, based on (optional) grouping columns. An optional window frame can be specified to compute sliding window aggregation.

Usage

timechart [ options ], bin_duration [ , frame ] [ , groupby ] ..., groupOrAggregateFunction ...

Argument

Type

Required

Multiple

options

options

Optional

Only one

bin_duration

duration

Required

Only one

frame

frame

Optional

Only one

groupby

fieldref

Optional

Can be multiple

groupOrAggregateFunction

expression

Required

Can be multiple

Options

Option

Type

Meaning

empty_bins

bool

Generate output even for bins in the time window that have no data (not accelerable)

Accelerable

timechart is sometimes accelerable, depending on options used. A dataset that only uses accelerable verbs, can be accelerated, making queries on the dataset respond faster.

Examples

timechart 1h, Count:count(1), group_by(server_name)

Group input point table by server name, calculating a count of rows through time per server name per hour, returning a dataset with the 5 columns ‘valid_from’, ‘valid_to’, ‘bucket’, ‘server_name’, and ‘Count’.

timechart 1h, frame(back:24h), Count:count(1), group_by(server_name)

Group input point table by server name, calculating a moving count of rows through time per server name per hour, with each count covering the 24 hour window ending at the hour.

timechart options(empty_bins:true), 1h, Count:count(1), group_by(server_name)

Similar to the first example, but generate a row with NULL value for each time bin in the query window with no matching input rows. Because of empty_bins, the query may run slowly, especially if the input data points are sparse.

Aliases

  • bucketize