| Table of Contents | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
Create time buckets for the given table of a specified length. Each event is assigned to a time bucket based on its start and end time. The start time of the bucket is saved in lhub_start_ts and the end time of the bucket is saved in lhub_end_ts for each event.
...
Output
The input table with lhub_start_ts and lhub_end_ts columns added.
Example
Input
table
lhub_ts |
|---|
11/30/2017 23:35:29 |
11/30/2017 23:35:44 |
11/30/2017 23:35:54 |
LQL command
| Code Block |
|---|
timeBucket(table, "10s") |
Output
lhub_ts | lhub_start_ts | lhub_end_ts |
|---|---|---|
11/30/2017 23:35:29 | 11/30/2017 23:35:20 | 11/30/2017 23:35:30 |
11/30/2017 23:35:44 | 11/30/2017 23:35:40 | 11/30/2017 23:35:50 |
11/30/2017 23:35:54 | 11/30/2017 23:35:50 | 11/30/2017 23:36:00 |
Notelhub_ts is a timestamp in millisecond (long format). The UI renders it in human readable format ("mm/dd/yy HH:MM:SS").