count of events between multiple timestamps in a single event

[sethrife]

As an example, suppose I'm trying to count the number of concurrent HTTP sessions. Events look something like the following:

Event 1: start=[02/05/2013 13:18] end=[02/05/2013 14:20]

Event 2: start=[02/05/2013 13:58] end=[02/05/2013 15:50]

Event 3: start=[02/05/2013 13:50] end=[02/05/2013 14:02]

What I'm trying to do is count the number of concurrent sessions over some range of time, say 24 hours. So in the above example, I'm trying to get the following:

Date	Active Session Count
02/05/2013 13:30	1
02/05/2013 14:00	3
02/05/2013 14:30	1

Is something like this possible?

[gkanapathy]

Yes. You need to calculate a duration (eval duration=strptime(end)-_time, if start is the timestamp of the event), and you can then use the concurrency search command.

Alternatively, you can create separate events for start and end, and simply count the number of start events and number ofend events since the beginning of your time range, and take the difference to get the concurrency.