Using clustering to calculate start and end of a process

[andreafebbo]

Hi all

I have some events which represent something like a ping.

For example :
_time: a time stamp
doing it: 1
database: db1
server: server1

so i get something like this:

the color represent the DB.
Now, what i need to do is to write a query which understands that there are 2 groups of events for the violet db and that gives me that _time of the first event and the rime od the last event of every group, like in the next image.

I think this can be achieved using clustering, just i dont know how (maybe with k means method).

Can you help me?

[woodcock]

Like this:

... | transaction max_pause=5m database server | eval start = _time, end = _time + duration

[somesoni2]

Give transaction command a try.

your base search | transaction database server | eval start=_time | eval end=_time+duration