This is a follow up question to a previously answered question I asked on timechart counts (here). Now that I've got the count fixed with a bin and dedup, I'm trying to figure out how to co-mingle data sources of varying polling intervals. How would I go about merging disparate data sources with separate extracts that have different polling intervals? For example, when comparing a 10 minute poll interval extract with a 5 minute, I get gaps in the longer interval source (because of the bin); here's a sample query, and screenshot of the timechart: .. sourcetype=server:sessions OR sourcetype=switch:sessions | bin _time span=5m | dedup UserName, _time | timechart count(serverfield) as ActiveServer, count(switchfield) as ActiveSwitch How would I normalize the 10 minute extract next to the 5 minute in the same timechart? Is there some way to fill in the gaps for the extract that runs less frequently? ... View more

I'm struggling with counting session table exports that dump active sessions every five minutes. Basically I keep running into a problem where the count overlaps with a previous export every few intervals. The data looks something like this: Time="3:00:00.000 PM" User="user 1" Time="3:00:00.000 PM" User="user 2" Time="3:00:00.000 PM" User="user 3" Time="3:05:00.000 PM" User="user 1" Time="3:05:00.000 PM" User="user 2" Time="3:10:00.000 PM" User="user 1" Here's a sample search: ... | timechart span=5m count(_raw) as ActiveSessions Which results in the attached visualization screenshot, where the data overlaps at certain points and incorrectly counts events from the previous polling interval. I'm guessing that this is because the exports aren't running/completing exactly every five minutes, and so the span is intermittently counting two sets of exports. For example, how do you do a proper count if an extract is off by a second in a given polling interval; like this: Time="3:00:00.000 PM" User="user 1" Time="3:00:00.000 PM" User="user 2" Time="3:00:00.000 PM" User="user 3" Time="3:05:01.000 PM" User="user 1" Time="3:05:01.000 PM" User="user 2" Time="3:10:00.000 PM" User="user 1" Is there another way to get at this metric? I started looking into concurrency, but didn't have much luck. ... View more