@@ -7,6 +7,7 @@ FROM sample_data
77| STATS min = MIN(@timestamp), max = MAX(@timestamp) BY bucket = TBUCKET(10 seconds)
88| SORT min
99;
10+ ignoreOrder:true
1011
1112min:datetime | max:datetime | bucket:datetime
12132023-10-23T12:15:03.360Z | 2023-10-23T12:15:03.360Z | 2023-10-23T12:15:00.000Z
@@ -26,6 +27,7 @@ FROM sample_data
2627| STATS min = MIN(@timestamp), max = MAX(@timestamp) BY bucket = TBUCKET("10 seconds")
2728| SORT min
2829;
30+ ignoreOrder:true
2931
3032min:datetime | max:datetime | bucket:datetime
31332023-10-23T12:15:03.360Z | 2023-10-23T12:15:03.360Z | 2023-10-23T12:15:00.000Z
@@ -44,6 +46,7 @@ FROM sample_data
4446| STATS min = MIN(@timestamp), max = MAX(@timestamp) BY bucket = TBUCKET(10 minutes)
4547| SORT min
4648;
49+ ignoreOrder:true
4750
4851min:datetime | max:datetime | bucket:datetime
49522023-10-23T12:15:03.360Z | 2023-10-23T12:15:03.360Z | 2023-10-23T12:10:00.000Z
@@ -60,6 +63,7 @@ FROM sample_data
6063| STATS min = MIN(@timestamp), max = MAX(@timestamp) BY bucket = TBUCKET("10 minutes")
6164| SORT min
6265;
66+ ignoreOrder:true
6367
6468min:datetime | max:datetime | bucket:datetime
65692023-10-23T12:15:03.360Z | 2023-10-23T12:15:03.360Z | 2023-10-23T12:10:00.000Z
@@ -223,8 +227,8 @@ FROM sample_data
223227| WHERE event_duration > 0
224228| KEEP @timestamp, client_ip, event_duration
225229| STATS count = COUNT(*), avg_dur = AVG(event_duration) BY hour = TBUCKET(1h), client_ip
226- | SORT avg_dur DESC
227230;
231+ ignoreOrder:true
228232
229233count:long | avg_dur:double | hour:datetime | client_ip:ip
2302344 | 3945955.75 | 2023-10-23T13:00:00.000Z | 172.21.3.15
@@ -241,8 +245,8 @@ FROM sample_data
241245| WHERE message == "Connection error"
242246| KEEP @*, message
243247| STATS errors = COUNT() BY day = TBUCKET(1d), message
244- | SORT day ASC, errors
245248;
249+ ignoreOrder:true
246250
247251errors:long | day:datetime | message:keyword
2482523 | 2023-10-23T00:00:00.000Z | Connection error
@@ -256,8 +260,8 @@ FROM sample_data
256260| WHERE client_ip IS NOT NULL
257261| KEEP *stamp*, client_ip, event_duration
258262| STATS p95 = PERCENTILE(event_duration, 95) BY ten_min = TBUCKET(10min), client_ip
259- | SORT ten_min ASC, p95
260263;
264+ ignoreOrder:true
261265
262266p95:double | ten_min:datetime | client_ip:ip
2632673450233.0 | 2023-10-23T12:10:00.000Z | 172.21.2.162
@@ -275,8 +279,8 @@ FROM sample_data
275279| STATS day_count = COUNT(), day_p95 = PERCENTILE(event_duration, 95) BY day = TBUCKET(1d), @timestamp
276280| WHERE day_count > 0
277281| STATS hour_count = COUNT(), hour_p95 = PERCENTILE(day_p95, 95) BY hour = TBUCKET(1h), day
278- | SORT day ASC, hour ASC, hour_count
279282;
283+ ignoreOrder:true
280284
281285hour_count:long | hour_p95:double | hour:datetime | day:datetime
2822862 | 3415965.8 | 2023-10-23T12:00:00.000Z | 2023-10-23T00:00:00.000Z
@@ -292,8 +296,8 @@ FROM sample_data
292296| STATS reqs = COUNT(), max_dur = MAX(event_duration) BY day = TBUCKET(1d), client_ip, @timestamp
293297| WHERE max_dur > 1000
294298| STATS spikes = COUNT() BY hour = TBUCKET(1h), client_ip, day
295- | SORT spikes DESC, client_ip ASC
296299;
300+ ignoreOrder:true
297301
298302spikes:long | hour:datetime | client_ip:ip | day:datetime
2993034 | 2023-10-23T13:00:00.000Z | 172.21.3.15 | 2023-10-23T00:00:00.000Z
@@ -310,8 +314,8 @@ FROM sample_data
310314| KEEP @timestamp, event_duration, message
311315| EVAL t = @timestamp
312316| STATS total = COUNT(*), med = MEDIAN(event_duration) BY d = TBUCKET(1d), message
313- | SORT med ASC
314317;
318+ ignoreOrder:true
315319
316320total:long | med:double | d:datetime | message:keyword
3173211 | 1232382.0 | 2023-10-23T00:00:00.000Z | Disconnected
@@ -331,8 +335,8 @@ FROM sample_data
331335| STATS total = COUNT(*), med = MEDIAN(event_duration) BY d = TBUCKET(1d), message, @timestamp
332336| WHERE total > 0
333337| STATS day_total = SUM(total), hour_med = MEDIAN(med) BY h = TBUCKET(1h), message
334- | SORT hour_med DESC
335338;
339+ ignoreOrder:true
336340
337341day_total:long | hour_med:double | h:datetime | message:keyword
3383423 | 5033755.0 | 2023-10-23T13:00:00.000Z | Connection error
0 commit comments