How to calculate the average number of hours an app is used per day?

[buttsurfer]

 I have logs that get generated every 5 min.    

time=2023-02-06 00:01:00, app=bema, currentUseCount=7
time=2023-02-06 00:06:00, app=bema, currentUseCount=7
time=2023-02-06 00:11:00, app=bema, currentUseCount=10
time=2023-02-06 00:16:00, app=bema, currentUseCount=8
time=2023-02-06 00:21:00, app=ash, currentUseCount=12
time=2023-02-06 00:26:00, app=ash, currentUseCount=10
time=2023-02-06 00:31:00, app=ash, currentUseCount=8
time=2023-02-06 00:36:00, app=ash, currentUseCount=9

 How can i calculate the hours spent on each app based on the above logs 

[richgalloway]

Based on the sample events shown, we know the apps were busy during the midnight hour on 6 Feb.  What we don't know is how much time the apps spent being doing work so we can't say how many hours were spent by each app.

You can use this query to see how much use each app received each hour.

index=foo app=* currentUseCount=*
| timechart span=1h sum(currentUseCount) as hourlyUseCount by app

[buttsurfer]

The currentUseCount is actually the amount of users currently using the app. So if we have 

time=2023-02-06 00:01:00, app=bema, currentUseCount=7
time=2023-02-06 00:06:00, app=bema, currentUseCount=7
time=2023-02-06 00:11:00, app=bema, currentUseCount=10
time=2023-02-06 00:16:00, app=bema, currentUseCount=3

it would be calculated like 7*5minutes + 7*5minutes + 10*5minutes + 3*Xminutes

[richgalloway]

I'm not sure it's safe to say the app was busy all 5 minutes, but it's better than nothing.

index=foo app=* currentUseCount=*
| eval busyMinutes=currentUseCount * 5
| timechart span=1h sum(busyMinutes) as busyMinutes by app