How to count the number of events within a dynamic time range? (StartTime + Duration)

[mspoerr]

Hello,

I have logs with the following fields:
StartTime (which is used as _time)
Duration (in seconds)

The goal now is to count the number of events in the same timerange (_time + duration)

i.e.:

StartTime            | Duration | EventNr
7/2/2015 8:45:00 AM  | 3600     | 1
7/2/2015 8:50:00 AM  | 600      | 2
7/2/2015 8:55:00 AM  | 600      | 3
7/2/2015 9:10:00 AM  | 1200     | 4
7/2/2015 10:00:00 AM | 1200     | 5

Range for Event #1 is from 8:45 to 9:45 -> 4 events in this timerange
Range for Event #2 is from 8:50 to 9:00 -> 2 events
...

Result should be a table:

EventNr | EventCount
1       | 4
2       | 2

...

Thanks,
Mathias

[woodcock · Accepted solution]

You can do this with the concurrency command like this:

... | concurrency duration=Duration output=EventCount

Here is another very "expensive" way to do it but it will work:

... | eval StartTime=_time | eaval EndTime = _time + Duration | map search="search _time>=$StartTime$ AND _time<=$EndTime$ | stats count AS EventCount | eval EventNr=$EventNr$"]

[henrysoon]

Pls using eventstats calculation.

[somesoni2]

How many rows that might be processed by the search? How many distinct EventNr can exists?

[mspoerr]

It's a csv with 3000 events and each event has it's distinct EventNr