I have several events that are structured like this: 2020-09-28T15:18:40Z duration=8.0 somevalue=42 otherfield=A 2020-09-28T15:18:45Z duration=2.0 somevalue=10 otherfield=B 2020-09-28T15:18:44Z duration=2.0 somevalue=10 otherfield=B Here "duration" is in seconds. I would like to transform those events to a kind of timechart by spreading the "somevalue" on the "duration" starting from the "_time" of the event. The span would be 1second for example. Another condition, is to be able to aggregate on "otherfield". I'm expecting something like this: _time sum(somevalue) otherfield=A sum(somevalue) otherfield=B 2020-09-28T15:18:40Z 42 0 2020-09-28T15:18:41Z 42 0 2020-09-28T15:18:42Z 42 0 2020-09-28T15:18:43Z 42 0 2020-09-28T15:18:44Z 42 10 2020-09-28T15:18:45Z 42 20 2020-09-28T15:18:46Z 42 10 2020-09-28T15:18:47Z 42 0 2020-09-28T15:18:48Z 42 0 2020-09-28T15:18:49Z 0 0 I tried to use the "concurrency" function but was not able to get the values spread on several intervals (only a value for the _time of the event).
... View more