Calculating weighted concurrency

[myandow]

I am trying to calculate a weighted concurrency across 3 different event types. Each of these event types has a single log entry that contains the type, the startTime, and EndTime. Each of the event types has a different weight associated with them, so using the straight up concurrency result returned by the concurrency command is not accurate. For instance:

eventA - weight 2
eventB - weight 3
eventC - weight 1

If eventC starts when 2 other eventCs are running then the concurrency is 3 (as returned by the concurrency command). But, if eventC starts when 2 other eventAs are running then the concurrency should be 5. If eventC starts when an EventA and an eventB are running then the concurrency should be 6. Any suggestions on how to calculate these weighted concurrency values?

[myandow · Accepted solution]

In case anyone else is trying to do this as well, this is what I found worked for me. I assigned the weights to each different event using case() then appended another search where I assigned EndTime to _time and applied the negative weights. Then using accum, kept a running sum of the weights, which then represents the Concurrency.

index=myIndex | eval Weight=case(eventType="eventA", 2, eventType="eventB", 3,eventType="eventC",1,1=1,0) | append [search index=myIndex | eval Weight=case(eventType="eventA", -2, eventType="eventB", -3,eventType="eventC",-1,1=1,0) | eval _time=EndTime | sort _time] | sort _time | accum Weight as Concurrency