sequence_detect 插件sequence_detect plugin

根据所提供的谓词检测序列出现次数。Detects sequence occurrences based on provided predicates.

T | evaluate sequence_detect(datetime_column, 10m, 1h, e1 = (Col1 == 'Val'), e2 = (Col2 == 'Val2'), Dim1, Dim2)

语法Syntax

T | evaluate sequence_detect (TimelineColumn, MaxSequenceStepWindow, MaxSequenceSpan, Expr1, Expr2, ..., Dim1, Dim2, ...)T | evaluate sequence_detect (TimelineColumn, MaxSequenceStepWindow, MaxSequenceSpan, Expr1, Expr2, ..., Dim1, Dim2, ...)

参数Arguments

  • T:输入表格表达式。T: The input tabular expression.
  • TimelineColumn:表示时间线的列引用必须出现在源表达式中TimelineColumn: column reference representing timeline, must be present in the source expression
  • MaxSequenceStepWindow:序列中 2 个顺序步骤之间允许的最大时间跨度的标量常数值MaxSequenceStepWindow: scalar constant value of the max allowed timespan between 2 sequential steps in the sequence
  • MaxSequenceSpan:序列的最大跨度的标量常数值,用于完成所有步骤MaxSequenceSpan: scalar constant value of the max span for the sequence to complete all steps
  • Expr1, Expr2, ...:定义顺序步骤的布尔谓词表达式Expr1, Expr2, ...: boolean predicate expressions defining sequence steps
  • Dim1, Dim2, ...:用于关联序列的维度表达式Dim1, Dim2, ...: dimension expressions that are used to correlate sequences

返回Returns

返回一个表,其中的每一行都表示出现的单个序列:Returns a single table where each row in the table represents a single sequence occurence:

  • Dim1, Dim2, ...:已用于关联序列的维度列。Dim1, Dim2, ...: dimension columns that were used to correlate sequences.
  • Expr1TimelineColumn, Expr2TimelineColumn, ...:包含时间值的列,表示每个顺序步骤的时间线。Expr1TimelineColumn, Expr2TimelineColumn, ...: Columns with time values, representing the timeline of each sequence step.
  • 持续时间:序列的整个时间范围Duration: the overall sequence time window

示例Examples

探索 StormEventsExploring Storm Events

以下查询将查看表 StormEvents(2007 年的天气统计),并显示在出现“Excessive Heat”(过热)天气后的 5 天内出现“Wildfire”(野火)的案例。The following query looks on the table StormEvents (weather statistics for 2007) and shows cases where sequence of 'Excessive Heat' was followed by 'Wildfire' within 5 days.

StormEvents
| evaluate sequence_detect(
        StartTime,
        5d,  // step max-time
        5d,  // sequence max-time
        heat=(EventType == "Excessive Heat"), 
        wildfire=(EventType == 'Wildfire'), 
        State)
状态State heat_StartTimeheat_StartTime wildfire_StartTimewildfire_StartTime 持续时间Duration
加利福尼亚CALIFORNIA 2007-05-08 00:00:00.00000002007-05-08 00:00:00.0000000 2007-05-08 16:02:00.00000002007-05-08 16:02:00.0000000 16:02:0016:02:00
加利福尼亚CALIFORNIA 2007-05-08 00:00:00.00000002007-05-08 00:00:00.0000000 2007-05-10 11:30:00.00000002007-05-10 11:30:00.0000000 2.11:30:002.11:30:00
加利福尼亚CALIFORNIA 2007-07-04 09:00:00.00000002007-07-04 09:00:00.0000000 2007-07-05 23:01:00.00000002007-07-05 23:01:00.0000000 1.14:01:001.14:01:00
南达科他SOUTH DAKOTA 2007-07-23 12:00:00.00000002007-07-23 12:00:00.0000000 2007-07-27 09:00:00.00000002007-07-27 09:00:00.0000000 3.21:00:003.21:00:00
德克萨斯TEXAS 2007-08-10 08:00:00.00000002007-08-10 08:00:00.0000000 2007-08-11 13:56:00.00000002007-08-11 13:56:00.0000000 1.05:56:001.05:56:00
加利福尼亚CALIFORNIA 2007-08-31 08:00:00.00000002007-08-31 08:00:00.0000000 2007-09-01 11:28:00.00000002007-09-01 11:28:00.0000000 1.03:28:001.03:28:00
加利福尼亚CALIFORNIA 2007-08-31 08:00:00.00000002007-08-31 08:00:00.0000000 2007-09-02 13:30:00.00000002007-09-02 13:30:00.0000000 2.05:30:002.05:30:00
加利福尼亚CALIFORNIA 2007-09-02 12:00:00.00000002007-09-02 12:00:00.0000000 2007-09-02 13:30:00.00000002007-09-02 13:30:00.0000000 01:30:0001:30:00