Grouping events by time within some milliseconds

[TBo123]

Hello there,

I hope there is someone who can help me. I want to group events that occur within some milliseconds. I tried the transaction command to solve this problem but the minimum of maxpause seems to be 1s. So I don't know how to get rid of this problem. Perhaps there is another solution..

The aim is to get tuples of events that occur within some time interval.

Thanks.

[TBo123]

I already tried bucket, but it was not the way I am looking for..

[TBo123 · Accepted solution]

I find a way to solve my problem.

I generate IDs for the events which should be grouping by this way:

First I used the delta command to get the difference "diff" between two Events then there is a chance to differ in ms

my base search | delta _time p=1 AS diff | eval ID=case(isnull(diff),1,diff>0.001,1,1=1,0) | accum ID

The result is a new field called ID which show the same ID for Events that occur within some milliseconds.

Thanks to somesoni2 who helped me solve this problem..

[martin_mueller]

Depending on your use case, bucket may be of help:

base search | bucket _time span=25ms | stats something something by _time

[somesoni2]

You may try to use "streamstats" command to get the timestamp of previous event and calculate the duration from it. You can then group events with smaller duration. Something like this

your base search | streamstats current=f window=1 first(_time) as prevTime | eval duration=_time | eval shouldGroup=if(duration < yourMinduration,"Y","N") ....