In this example, the session() function is used to analyze user sessions based on users click activity. The session() function groups events by a given timespan.

Example incoming data might look like this:

The query is used to analyze user sessions based on the users click activity. The query is useful, for example, to identify most/least active user sessions, detect potential automated behavior or just to understand user engagement levels.

Sample output from the incoming example data:

Note that each row represents an event (either pageview or click).

In this example, the query uses sort() and groupBy() functions to find query costs. The query filters logs in humio repository that are tagged with kind equal to logs and then returns the events where the class field has values containing c.h.j.RunningQueriesLoggerJob, searching for the specific value Highest Cost query.

Example incoming data might look like this:

The query is used to search across multiple repositories and output query costs for all users by repository. The query returns the count in a field named _count. Use this query to focus on live and static costs separately.

Sample output from the incoming example data:

It is possible to filter out on fields with no values in a given returned search result. In this example, all statuscode fields containing no value is filtered out from the final search result.

Example incoming data might look like this:

The query is used to filter out fields not containing any values from the returned search result.

Sample output from the incoming example data:

The sort() function can be used to sort values in a field bottom up. This is the opposite of the top() function, that can be used to find the most common values of a field in a set of events.

In this example, the sort() function is used to find the least common values of a field. Types of parsers used (type field) are grouped with their LogScale logging types (kind field) to find the least common values when searching for events of, for example, kinds metrics.

The query is used to find the least common values of a field in a set of events, in this example, identifying the least and most common type/kind combinations in an event set. Identifying rare combinations of type and kind could indicate unusual events or potential security issues. This type of query is useful in various scenarios, particularly for data analysis and understanding patterns in event sets.

Search Repository: humio

timestamp := formatTime(format="%H:%M")
| groupBy([thread],
function=[{sort("timestamp")
| collect("timestamp")}])

When using aggregation, you may want to sort on a field that is part of the aggregated set but not the main feature of the aggregated value. For example, sorting the values by their timestamp rather than the embedded value. To achieve this, you should use a function that sorts the field to be used as the sort field, and then use collect() so that the value from before the aggregation can be displayed in the generated event set. This query can be executed in the humio respository.

The result set will contain a list of the aggregated thread names sorted by the timestamp: