Description
The TimeStream will read Tuples from an underlying stream and expand a unix timestamp into the individual fields: year, month, day, hour, week, minute, second, milli-second).
This will allow rollups to made on any time grain. This should be very useful for time series log analysis.
Sample syntax:
rollup(
time(search(...,sort="timestamp asc", fl="timestamp,..."), field="timestamp")
over="year, month,day,hour,minute,second,millis",
sum(a_i),
sum(a_f),
min(a_i),
min(a_f),
max(a_i),
max(a_f),
avg(a_i),
avg(a_f),
count(*))
Example broken down by customer:
rollup(
time(search(...,sort="customer asc, timestamp asc", fl="timestamp,..."), field="timestamp")
over="customer, year, month,day,hour,minute,second,millis",
sum(a_i),
sum(a_f),
min(a_i),
min(a_f),
max(a_i),
max(a_f),
avg(a_i),
avg(a_f),
count(*))
To do parallel time series rollups just wrap in a parallel stream and add the partitionKeys to the search.
paralllel(..., (rollup(
time(search(...,sort="customer asc, timestamp asc", fl="timestamp,...", partitionKeys="customer"), field="timestamp")
over="customer, year, month,day,hour,minute,second,millis",
sum(a_i),
sum(a_f),
min(a_i),
min(a_f),
max(a_i),
max(a_f),
avg(a_i),
avg(a_f),
count(*)))
Attachments
Issue Links
- is superceded by
-
SOLR-10303 Add date/time Stream Evaluators
-
- Closed
-