This is a continuation of How to recognize a flat pattern in a given time period which @lguinn solved with a combination of appendpipe , head , and untable . It concerns three patterns in two distinct time periods. Now I realize that my | timechart count by ID contains three distinct time periods, resulting in more possible patterns.
In the graph, four different patterns are observable:
Flat, nonzero at beginning, then fluctuate all the way to end.
Flat, zero at beginning, then fluctuate all the way to end.
Fluctuate from beginning all the way to end.
Flat, nonzero at beginning, fluctuate in the middle, then flat, zero at end.
Though not in my case, one could easily extend this to several more "flat vs non-flat, zero vs nonzero" combinations. Using @lguinn's method, I can distinguish patterns at beginning by
mysearch | timechart count by ID
| appendpipe [ head 24
| untable _time ID count
| stats stdev(count) as sdev max(count) as max by ID
| eval headpattern=case(max==0,"Zero at beginning",
max>0 and sdev < .25,"Flat at beginning",
1==1,"Random")
| fields ID headpattern ]
| stats dc(ID) as Count by headpattern
I can also distinguish patterns at end by
mysearch | timechart count by ID
| appendpipe [ tail 24
| untable _time ID count
| stats stdev(count) as sdev max(count) as max by ID
| eval tailpattern=case(max==0,"Zero at end",
max>0 and sdev < .25,"Flat at end",
1==1,"Random")
| fields ID tailpattern sdev max ]
| stats dc(ID) as Count by tailpattern
However, if I try to combine the two in order to do | stats dc(ID) as Count by headpattern tailpattern , the magic disappears. Here is what I have tried:
mysearch | timechart count by ID
| appendpipe [ head 24
| untable _time ID count
| stats stdev(count) as sdev max(count) as max by ID
| eval headpattern=case(max==0,"Zero at beginning",
max>0 and sdev < .25,"Flat at beginning",
1==1,"Random")
| fields ID headpattern ]
| appendpipe [ tail 24
| untable _time ID count
| stats stdev(count) as sdev max(count) as max by ID
| eval tailpattern=case(max==0,"Zero at end",
max>0 and sdev < .25,"Flat at end",
1==1,"Random")
| fields ID tailpattern sdev max ]
| stats dc(ID) as Count by headpattern tailpattern
No result comes out. How can I detect patterns in both time regions?
... View more
