As an example, suppose I'm trying to count the number of concurrent HTTP sessions. Events look something like the following:
Event 1: start=[02/05/2013 13:18] end=[02/05/2013 14:20]
Event 2: start=[02/05/2013 13:58] end=[02/05/2013 15:50]
Event 3: start=[02/05/2013 13:50] end=[02/05/2013 14:02]
What I'm trying to do is count the number of concurrent sessions over some range of time, say 24 hours. So in the above example, I'm trying to get the following:
Date | Active Session Count |
02/05/2013 13:30 | 1 |
02/05/2013 14:00 | 3 |
02/05/2013 14:30 | 1 |
Is something like this possible?
Yes. You need to calculate a duration (eval duration=strptime(end)-_time
, if start
is the timestamp of the event), and you can then use the concurrency
search command.
Alternatively, you can create separate events for start and end, and simply count the number of start
events and number ofend
events since the beginning of your time range, and take the difference to get the concurrency.