@@ -12,12 +12,12 @@ event_duration:long | message:keyword
1212first_grouped
1313required_capability: fn_first_last
1414FROM sample_data
15- | STATS event_duration = first_value(event_duration), message = first_value(message) BY @timestamp = BUCKET(@timestamp, 1 hour)
16- | SORT @timestamp
17- | KEEP @timestamp , event_duration, message
15+ | STATS event_duration = first_value(event_duration), message = first_value(message) BY hourly = BUCKET(@timestamp, 1 hour)
16+ | SORT hourly
17+ | KEEP hourly , event_duration, message
1818;
1919
20- @timestamp :date | event_duration:long | message:keyword
20+ hourly :date | event_duration:long | message:keyword
21212023-10-23T12:00:00.000Z | 3450233 | Connected to 10.1.0.3
22222023-10-23T13:00:00.000Z | 1232382 | Disconnected
2323;
@@ -26,12 +26,12 @@ FROM sample_data
2626first_grouped_long
2727required_capability: fn_first_last
2828FROM sample_data
29- | STATS event_duration = first_value(event_duration) BY @timestamp = BUCKET(@timestamp, 1 hour)
30- | SORT @timestamp
31- | KEEP @timestamp , event_duration
29+ | STATS event_duration = first_value(event_duration) BY hourly = BUCKET(@timestamp, 1 hour)
30+ | SORT hourly
31+ | KEEP hourly , event_duration
3232;
3333
34- @timestamp :date | event_duration:long
34+ hourly :date | event_duration:long
35352023-10-23T12:00:00.000Z | 3450233
36362023-10-23T13:00:00.000Z | 1232382
3737;
0 commit comments