Starting with the source repository events.

#type=humio #kind=logs

Filters on all logs across all hosts in the cluster.

| loglevel=WARN

Filters for all events where the loglevel is equal to WARN.

| class = c.h.d.ParserLimitingJob

Assigns the value c.h.d.ParserLimitingJob to the class for the logs having the loglevel value WARN.

| "Setting reject ingest for"

Filters for events containing the string Setting reject ingest for. This is the error message generated when ingested events are rejected.

| groupBy(id, function=[count(), min(@timestamp), max(@timestamp)] )

Groups the returned result by the field id, makes a count on the events and returns the minimum timestamp and maximum timestamp. This returns a new event set, with the fields id, _count, _min, and _max.

| timeDiff:=_max-_min

Calculates the time difference between the maximum timestamp values and the minimum timestamp values and returns the result in a new field named timeDiff.

| timeDiff > 300000 and _count > 10

Returns all events where the values of timeDiff is greater that 300000 and where there are more than 10 occurrences.

Event Result set.

Starting with the source repository events.

maxTimes := array:reduceColumn(times, var=x, function={time := max(x)})

Computes the maximum time for each array element with same index in the array and reduces it to one value.

Event Result set.

Starting with the source repository events.

array:reduceAll("values[]", var=x, function=max(x))

Computes the maximum value over all the values within the array values[] by using the max() on each element, and then across each event in the event set.

Event Result set.

Starting with the source repository events.

groupBy([type,actor.user.id],function={groupBy(actor.user.id, function=max(@timestamp))})

The first step to creating a pivot table is the base query that will create the initial summary of the information. In this fragment, a nested groupBy() aggregation. The embedded aggregation creates a group of the maximum access time for a given user, by using max() on the @timestamp against the actor.user.id. This creates a table of the last event by the user. The outer groupBy() then creates an aggregation of this maximum user time against the type which defines the operation performed.

The result is a table of the last user and time for a specific operation; for example, the last time a query was executed. An example of this table can be seen below:

|transpose(header=type)

The transpose() will convert individual columns into rows, switching the orientation. For example, the type column will now become the type row. However, there are no row titles, so the title for the resulting table will by default create a header row containing the column and row numbers, like this:

However, the aggregate grouping, type could be used instead as a valid header for each column. To achieve that, use the header parameter to specify type as the column. The resulting table now looks like this:

|drop(column)

The table created contains the summarized information pivoted around the user ID and last event time further summarized by the type of the event. However, there is a column in the table, column, which is now a field in the event stream that was generated from the old row before the table was pivoted.

That column can be removed by dropping the column field from the event using drop() to remove the column from the events.

Event Result set.

Starting with the source repository events.

timeChart(function=max(value))

Creates a Time Chart using max() as the aggregate function for the value field.

| round(_max, how=floor)

Rounds the implied field from the aggregate max() using the floor option to round down the value.

Event Result set.