Collects events into sessions, which are series of events that are no further than maxpause apart (defaults to 15m), and then performs an aggregate function across the events that make up the session.

ParameterTypeRequiredDefaultDescription
function[Aggregate]falsecount(as=_count)Specifies which aggregate functions to perform on each session. Default is to count(as=_count) the elements in each group.
maxpausestringfalse15mDefines the maximum pause between sessions i.e., events more than this far apart will become separate sessions. Defaults to 15m.

Examples

Count unique visitors (each visitor defined as non-active for 15 minutes)

humio
groupby(client_ip, function=session(maxpause=15m)) | count()

Find the visits with most clicks

humio
groupby(cookie_id, function=session(maxpause=15m, count(as=clicks))) | sort(clicks)

Find the minimum and maximum values of the field bet within each session

humio
groupby(cookie_id, function=session([max(bet),min(bet)]))