In this example, the neighbor() function is used to look at the preceeding event; the one just before the current event as no distance is specified.

Note that the neighbor() function must be used after an aggregator function to ensure event ordering.

Example incoming data might look like this:

In this example, the value of a field from a preceding event is added to each event.

Sample output from the incoming example data:

The query is useful for comparing events or detecting patterns in sequential data.

In this example, the neighbor() function is used to look at the succeeding event; the one just after the current event as no distance is specified.

Note that the neighbor() function must be used after an aggregator function to ensure event ordering.

Example incoming data might look like this:

The query is used to access fields from a single neighboring event in a sequence, retrieving fields from either a preceding or succeeding event at a specified distance (number of events) from the current event.

Sample output from the incoming example data:

The query is useful for comparing event values or detecting patterns in sequential data.

In this example, the neighbor() function is used to look at a preceeding event with the specified distance of 2 away from the current event.

Note that the neighbor() function must be used after an aggregator function to ensure event ordering.

Example incoming data might look like this:

The query is used to access fields from each event at a specified distance (number of events) away in a sequence of events, retrieving fields from either a preceding or succeeding event at a specified distance from the current event.

Sample output from the incoming example data:

The query is useful for comparing events with others that are not immediately adjacent in your data sequence.

Accumulations can be partitioned based on a condition, such as a change in value. This is achieved by combining the three functions partition(), neighbor() and accumulate(). In this example, the combination of the 3 sequence functions is used to count events within partitions defined by changes in a key field.

Note that sequence functions must be used after an aggregator function to ensure event ordering.

Example incoming data might look like this:

The query is used to compute an accumulated count of events within partitions based on a specific condition, in this example change in value for the field key.

Sample output from the incoming example data:

The query is useful for analyzing sequences of events, especially when you want to identify and count consecutive occurrences of a particular attribute in order to identify and analyze patterns or sequences within your data.

In this example, the neighbor() function is used to detect changes in values and alert on large increase.

Note that the neighbor() function must be used after an aggregator function to ensure event ordering.

Example incoming data might look like this:

The query is used to detect changes in values and alert on a quantified increase. The query will identify events where the value has increased by more than 5 compared to the previous event.

Sample output from the incoming example data:

The query is useful for real-time monitoring and alerting systems where you need to quickly identify significant changes in sequential data. It allows for immediate detection of anomalies or important shifts in your data, enabling prompt responses to potential issues or opportunities.

In this example, the neighbor() function is used with accumulate() to calculate a running total of durations.

Note that the neighbor() function must be used after an aggregator function to ensure event ordering.

Example incoming data might look like this:

The query is used to calculate the time difference between consecutive events. The format of this query is a useful pattern when analyzing temporal data, to provide insights into process efficiency, system performance over time etc. In this example, the acculated_duration provides a value that can be used to compare against the duration field within each event.

Sample output from the incoming example data:

For example, in the results, the third event shows a large increase in duration against the accumulated_duration and the start time of the previous event (in prev.start). If analyzing execution times of a process, this could indicate a fault or delay compared to previous executions.

In this example, the slidingWindow() function combined with neighbor() is used to detect continuously upwards going trend. It looks for sequences where the value is consistently increasing or staying the same over at least two consecutive measurements.

Note that sequence functions must be used after an aggregator function to ensure event ordering.

Example incoming data might look like this:

The query is used to detect a continuous upwards trend in a series of values. The query can be used to monitor system metrics for consistent increases (for example, memory usage, CPU load) and to identify potential anomalies in time-series data.

Sample output from the incoming example data: