Oracle Cloud Infrastructure Documentation

timecluster

Use this command to group the timeseries charts together based on how similar they are to one another.

Syntax

timecluster [<timecluster_options>] <stats_function> (<field_name>) [as new_field_name] [, <stats_function> (<field_name>) [as new_field_name]]* by <field_name> [, <field_name>]*

Parameters

The following table lists the parameters used with this command, along with their descriptions.

Parameter Description

timecluster_options

Use this parameter to specify how the data should be bucketed. Permitted values for this parameter must follow the format [span = <int><timescale>] [field = <field_name>][maxvalues = <limit>][name = <chart_name>].

span

Use this parameter to set the size of each bucket, using a span length based on time. Permitted values for this parameter must follow the format <int><timescale>.

Use the timescale parameter to specify the time for sizing the buckets. Permitted values for this parameter must be either <sec>, <min>, <hour>, <day>, <week>, <mon>.

Syntax for timescale:

sec: Permitted values for this parameter include s, sec, secs, second, and seconds.

min: Permitted values for this parameter include m, min, mins, minute, or minutes.

hour: Permitted values for this parameter include h, hr, hrs, hour, and hours.

week: Permitted values for this parameter include w, week, and weeks.

mon: Permitted values for this parameter include mon, month, and months.

field

Field must have a timestamp value. If not specified Start Time is used.

maxvalues

Reduce the number of aggregated values to return for a function.

name

Name to display for the chart.
Note

You can use the functions that are associated with the stats command with the timecluster command too. For details about the functions and the examples of using the functions with the command, see stats.

For example of using this command in typical scenarios, see:

The following query clusters the timeseries pattern by entity.

* | link Entity, Severity | stats sum('Content Size') as 'Content Size' | timecluster avg('Content Size') by Entity

The following query clusters the timeseries patterns by entity only for fatal logs.

* | link Entity, Severity | stats sum('Content Size') as 'Content Size' | addfields [ * | where Severity = fatal | timecluster avg('Content Size') by Entity ]