I'm trying to collapse a of data into earliest/lastest by _time, with the time is contiguous.
Such as:
2022-08-27 07:36:00
2022-08-27 07:37:00
2022-08-27 07:38:00
2022-08-27 07:39:00
2022-08-27 07:40:00
2022-08-27 07:44:00
2022-08-27 07:45:00
2022-08-27 07:46:00
2022-08-27 08:31:00
2022-08-27 08:32:00
2022-08-27 08:33:00
2022-08-27 08:34:00
2022-08-27 08:35:00
earliest: latest:
2022-08-27 07:36:00 2022-08-27 07:40:00
2022-08-27 07:44:00 2022-08-27 07:46:00
2022-08-27 08:31:00 2022-08-27 08:35:00
THoughts?
Assuming your _time fields are already align or binned to the minute and are in ascending order, try something like this:
| streamstats range(_time) as previous_gap window=2
| reverse
| streamstats range(_time) as next_gap window=2
| where previous_gap != 60 OR next_gap != 60
| streamstats current=f window=1 values(_time) as latest
| where next_gap=60
| reverse
| rename _time as earliest
| fields earliest latest
| fieldformat earliest=strftime(earliest,"%F %T")
| fieldformat latest=strftime(latest,"%F %T")
Assuming your _time fields are already align or binned to the minute and are in ascending order, try something like this:
| streamstats range(_time) as previous_gap window=2
| reverse
| streamstats range(_time) as next_gap window=2
| where previous_gap != 60 OR next_gap != 60
| streamstats current=f window=1 values(_time) as latest
| where next_gap=60
| reverse
| rename _time as earliest
| fields earliest latest
| fieldformat earliest=strftime(earliest,"%F %T")
| fieldformat latest=strftime(latest,"%F %T")
Outstanding sir - thank you! I would have never come up with that.