session() Query Function

Collects events into sessions, which are series of events that are no further than maxpause apart (defaults to 15m), and then performs an aggregate function across the events that make up the session.

Parameters

Name

Type

Required

Default

Description

maxpause

string

No

15m

Defines the maximum pause between sessions i.e., events more than this far apart will become separate sessions. Defaults to 15m.

function

[Aggregate]

No

count(as=_count)

Specifies which aggregate functions to perform on each session. Default is to count(as=_count) the elements in each group.

The implied parameter is function.

Examples

Count unique visitors (each visitor defined as non-active for 15 minutes)

humio
groupby(client_ip, function=session(maxpause=15m)) | count()

Find the visits with most clicks

humio
groupby(cookie_id, function=session(maxpause=15m, count(as=clicks))) | sort(clicks)

Find the minimum and maximum values of the field bet within each session

humio
groupby(cookie_id, function=session([max(bet),min(bet)]))