I have logs that get generated every 5 min.
time=2023-02-06 00:01:00, app=bema, currentUseCount=7
time=2023-02-06 00:06:00, app=bema, currentUseCount=7
time=2023-02-06 00:11:00, app=bema, currentUseCount=10
time=2023-02-06 00:16:00, app=bema, currentUseCount=8
time=2023-02-06 00:21:00, app=ash, currentUseCount=12
time=2023-02-06 00:26:00, app=ash, currentUseCount=10
time=2023-02-06 00:31:00, app=ash, currentUseCount=8
time=2023-02-06 00:36:00, app=ash, currentUseCount=9
How can i calculate the hours spent on each app based on the above logs
Based on the sample events shown, we know the apps were busy during the midnight hour on 6 Feb. What we don't know is how much time the apps spent being doing work so we can't say how many hours were spent by each app.
You can use this query to see how much use each app received each hour.
index=foo app=* currentUseCount=*
| timechart span=1h sum(currentUseCount) as hourlyUseCount by app
The currentUseCount is actually the amount of users currently using the app. So if we have
time=2023-02-06 00:01:00, app=bema, currentUseCount=7
time=2023-02-06 00:06:00, app=bema, currentUseCount=7
time=2023-02-06 00:11:00, app=bema, currentUseCount=10
time=2023-02-06 00:16:00, app=bema, currentUseCount=3
it would be calculated like 7*5minutes + 7*5minutes + 10*5minutes + 3*Xminutes
I'm not sure it's safe to say the app was busy all 5 minutes, but it's better than nothing.
index=foo app=* currentUseCount=*
| eval busyMinutes=currentUseCount * 5
| timechart span=1h sum(busyMinutes) as busyMinutes by app