concurrency
Use the concurrency to count the number of events with the spans that overlap with the start of each event.
Syntax
table_name|concurrency concurrency_duration=<field> [concurrency_start=<field>][concurrency_output=<field>]
concurrency_duration=<field>
|
Required. Specify the numeric field that contains the duration taken by an event. The units in this field must match the units in the field used as |
concurrency_start=<field>
|
Optional. Specify the field that denotes the event start. Default: |
concurrency_output=<field>
|
Optional. Specify the field in which the concurrency calculation results will be stored. Default: |
Usage
You can use the concurrency to calculate the count of events going on at the moment when each event starts, including the event itself. This calculation does not provide the overall number of events with which a specific event overlaps throughout its entire duration.
Examples
Example 1: Calculate concurrent event overlap using duration field.
table_name|concurrency concurrency_duration=durationExample 2: Count concurrent events from a custom date field.
table_name|concurrency concurrency_duration=duration concurrency_start=event_datesExample 3: Store concurrency results in a custom output field.
table_name|concurrency concurrency_duration=duration concurrency_start=event_dates concurrency_output=conExample 4: Calculates the number of concurrently active events at each point in time across the first 50 OCSF events, using event_time as both the start and duration reference.
ocsf | limit 50 | concurrency concurrency_duration=event_time concurrency_start=event_time