timestats

Type of operation: Aggregate

Description

Aggregate resource columns at every point in time, based on (optional) grouping columns. For example, if you have a resource with a primary key “switch id, port id” and you want to calculate values by “switch id” and retaining full temporal resolution, you would use timestats, as opposed to timechart which buckets data into evenly-sized bins.

If groupby is not specified, the default grouping will be used. The default grouping for timestats is the set of primary key columns. This means that the count of events on the default grouping per point in time will usually be one, so you will usually want to use a grouping other than the default.

Usage

timestats [ groupby ] ..., groupOrAggregateFunction ...

Argument	Type	Required	Multiple
groupby	fieldref	Optional	Can be multiple
groupOrAggregateFunction	expression	Required	Can be multiple

Accelerable

timestats is always accelerable if the input is accelerable. A dataset that only uses accelerable verbs can be accelerated, making queries on the dataset respond faster.

Examples

// assume input is Process, with primary key:
// - server_name
// - process_id
timestats ProcessCount:count(1), group_by(server_name)

Calculate the number of processes for each point in time per server name, returning a dataset with the 4 columns ‘valid_from’, ‘valid_to’, ‘server_name’, and ‘ProcessCount’. As opposed to timechart, this calculates values that change at any point in time, whereas timechart calculates aggregates per fixed bucket.