topic Using clustering to calculate start and end of a process in Deployment Architecture

Using clustering to calculate start and end of a process

andreafebbo — Fri, 27 Jan 2017 15:42:53 GMT

Hi all

I have some events which represent something like a ping.

For example :
_time: a time stamp
doing it: 1
database: db1
server: server1

so i get something like this:

the color represent the DB.
Now, what i need to do is to write a query which understands that there are 2 groups of events for the violet db and that gives me that _time of the first event and the rime od the last event of every group, like in the next image.

I think this can be achieved using clustering, just i dont know how (maybe with k means method).

Can you help me?

Re: Using clustering to calculate start and end of a process

somesoni2 — Fri, 27 Jan 2017 15:49:35 GMT

Give transaction command a try.

your base search | transaction database server | eval start=_time | eval end=_time+duration

Re: Using clustering to calculate start and end of a process

woodcock — Sun, 05 Mar 2017 05:29:52 GMT

Like this:

... | transaction max_pause=5m database server | eval start = _time, end = _time + duration