I would like to generate a graph of total number of active sessions per hour. the issue is of course the sessions longer than 1 hour. I made various attempts with suggestions for previous posts but did not find any suitable solution (i can successfully use concurrency, but here i'm not trying to measure to number of concurrent sessions, but the total of sessions within an hour). The only solution as far as i understand is to create additional results for the same event using map and gentimes.
This request seems to do almost what i'm looking for when only a small dataset is returned by the first search (in the example i had to take only one clientID), it does not work with more results (like 20.000) returned by the first search. i understand the issue, as many search requests needs to be done.
Would anyone could suggest another approach ? i could change the logs we capture to add intermediate events, but i would like to avoid that if possible.