How would I do this in SPL?
I want to calculate a tracking session:
Find an ENTER event in the log.
Search forward in the log data for events after this event with the same device ID and same account ID. Sort them by date (ascending).
Walk through the log events in order, adding them to the session. If any of the following occurs, we stop searching:
If the next is more than "session timeout" (default 5 minutes) after the previous event in the session, consider the session terminated.
If an EXIT or TIMEOUT event occurs, consider the session terminated.
Find the last non-timeout event.
Session duration calculation is based on the time difference between the first event and the last non-timeout event.
