Greetings,
I need to search for requests from the same username that occur within certain time interval, say, less than 100ms and output various request attributes. How can the query be constructed to extract such requests?
Thanks in advance
Maybe start with something like
base search
| streamstats time_window=100ms values(*) as * by user
where the field 'user' is your username field, but at this point, it very much depends on what you want to do with that data
That's a very good start, @bowesmana. Two additions...
1) As a practice, we always include in the pseudocode a fields command to limit the junk and speed the search. If beginners learn that strategy early on, it will save them centuries of machine time. When doing values(*) as *, it's especially important.
2) streamstats is finicky with time_window, so if we're doing anything complicated, then we usually include a sort 0 to explicitly validate the event order right before the streamstats.
base search
| fields _time user ... the exact fields that you want to know about ...
| sort 0 _time user
| streamstats time_window=101ms values(*) as * by user
I gave it 1 extra ms, since I can never remember whether streamstats is inclusive or exclusive, and with ms it might matter.
Good point @DalJeanis about the wildcards - you're right, that particular construct is not something you're ever likely to want to do on _raw data given all the additional fields you'd collect on the way, so worth pointing out.