make_session¶

Description¶

Group events or intervals that are close to each other into sessions, and calculate aggregations over each session.

Two events or intervals would be assigned to the same session if the time period between them is below the session gap (default to one day). Two overlapped events or intervals will always be mapped to the same session. The output’s ‘valid_from’ and ‘valid_to’ fields would mark the start and end time of the session.

If group_by is not specified, the default grouping will be used. The default grouping for make_session is the set of primary key columns.

Note that applying make_session over existing sessions may result in unexpected results. For instance, calculating average again over an already averaged column will not result in the correct average overall.

Note that the session gap calculation is slightly different between events or intervals input. For event input, two events are assigned to the same session if the difference between their timestamp is less than or equal to the session gap (e.g., when session gap is 1ns, only two overlapped or immediately adjacent events are assigned to the same session). For interval input, two intervals are assigned to the same session if the distance between them is less than the session gap (e.g., when session gap is 1ns, only two overlapped or “touching” intervals are assigned to the same session).

Usage¶

make_session [ options ], [ groupby_1, groupby_2, ... ], groupOrAggregateFunction_1, groupOrAggregateFunction_2, ...

Argument	Type	Optional	Repeatable	Restrictions
options	options	yes	no	constant
groupby	storable	yes	yes	column
groupOrAggregateFunction	expression	no	yes	none

Options¶

Option	Type	Meaning
session_gap	duration	The gap between two sessions with the same grouping key. If two sessions are closer than this gap, they will be merged into one session. Note that for performance reason, if two sessions are farther apart than this gap, they may also be merged. If you want to avoid this, use the session_gap_exact option.
session_gap_exact	duration	The gap between two sessions with the same grouping key. If two sessions are closer than this gap, they will be merged into one session. If two sessions are farther apart than this gap, they will not be merged. The option can be significantly slower than the session_gap option.
expiry	duration	Deprecated. It is an alias of session_gap_exact.

Accelerable¶

make_session is always accelerable if the input is accelerable. A dataset that only uses accelerable verbs can be accelerated, making queries on the dataset respond faster.

Examples¶

make_session cnt:count(1), group_by(server_name)

Group input events or intervals into per server name sessions, and count the number of events or intervals in each session. Return a dataset with 4 columns ‘valid_from’, ‘valid_to’, ‘server_name’, and ‘cnt’.

make_session options(session_gap:10m), cnt:count(1), group_by(server_name)

Similar to the above example, but expire each session after 10 minutes of inactivity (no new event falls into the session).

Aliases¶

makesession (deprecated)