Profiler Group By Example.md

Here is an example using the Profiler's "Group By" functionality. It is often the case that patterns and behaviors will differ based on calendar effects like day of week. For example, activity on a weekday can be very different from a weekend. The Profiler's "Group By" functionality is one way to account for calendar effects.

This profile definition operates over any incoming telemetry that has an ip_src_addr and a timestamp field. It produces a profile that segments the data by the day of week. It does by using a 'groupBy' expression to extract the day of week from the telemetry's timestamp field.

{
  "profiles": [
    {
      "profile": "calender-effects",
      "onlyif":  "exists(ip_src_addr) and exists(timestamp)",
      "foreach": "ip_src_addr",
      "init":    { "count": 0 },
      "update":  { "count": "count + 1" },
      "result":  "count",
      "groupBy": ["DAY_OF_WEEK(TO_EPOCH_TIMESTAMP(timestamp, 'yyyy-MM-dd HH:mm:ss', 'GMT'))"]
    }
  ]
}

When retrieving profile data using the Profiler Client API, I only want to retrieve data from the same day of week to account for any calendar effects. The following example retrieves profile data only for Thursdays over the past 60 days.

>>> thursday := 5
>>> PROFILE_GET("calendar-effects", "10.0.0.1", PROFILE_FIXED(60, "DAYS"), [thursday])