I'm trying to get the total number of hours a user is connected to a workspace per month. I am getting the raw data every 5 minutes, which contains the number of users connected for the last 5 minutes.
I noticed that the results for the month of May is different when I ran the query a few days earlier in the week. I'm puzzled as to why it would produce different results.
The query is:
index="aws" sourcetype="aws:cloudwatch" metric_name="UserConnected"
| lookup workspaces_directory.csv metric_dimensions OUTPUTNEW directory_name
| rename account_id AS owner_id
| lookup owner_id.csv owner_id OUTPUTNEW account
| eval month_num=strftime(_time, "%m")
| bucket _time span=5m
| stats max(Sum) AS max_connected BY _time, account, directory_name, month_num
| stats sum(max_connected) AS users_connected_per_5_min BY directory_name, month_num
| eval "Hours Connected" = (users_connected_per_5_min*5.0)/60.0
| chart sum("Hours Connected" by directory_name, month_num
Since I am getting data every 5 minutes, I bin up the data into the maximum number of users connected per 5 minutes, then multiplying by 5 to get the total number of minutes that the user was logged on per hour. The total is then grouped by month and summed together.
What I'd like to find is why I'm getting different results from when I ran the same query a few days ago. It's past the month of May, so the underlying data should not have changed at all.
Any insight would be appreciated.
