Reference to the since() function

Summary

since(<eventsExpression>)

since(<timeWindow>)

You can use since() with an event set or with a time window.

Event set transformation function Returns a set of synthetic ongoing events that start at the same time as the events described by eventsExpression, but have no end time.
Event creation
function
Creates a single synthetic event that started timeWindow ago and ended “now”.

Parameters

Event Set Transformation Function

ParameterDescription
eventExpression Set of events that determine the start times of the returned synthetic events.

Event Creation Function

ParameterDescription
timeWindow Length of the new event. You can specify a time measurement based on the clock or calendar (1s, 1m, 1h, 1d, 1w), the window length (1vw) of the chart, or the bucket size (1bw) of the chart. Default is minutes if the unit is not specified.

Description

You can use the since() event function:

  • With an eventsExpression to return a set of synthetic events.
  • With a timeWindow to return a single synthetic event.

Note: Synthetic events are displayed by the query, but not stored in Wavefront.

Event Set Transformation Function

The since() event set transformation function returns a set of synthetic ongoing events, where each synthetic event:

  • Starts at the same time as a corresponding event described by the expression.
  • Continues indefinitely.

In effect, since() transforms all input events to ongoing events.

The following diagram represents an events() query that returns 3 events (A, B, and C). Using that events() query as the input to since() produces 3 synthetic events that each start at the same time as the corresponding input event:

Events since

Event Creation Function

The since() event creation function creates a single synthetic event that started a specified time earlier and continues to “now”. In a live data chart, the start time moves forward in time so that the event always ends at the current time.

The following screen shot shows a single synthetic event that started 15 minutes before “now”, and continues up to the current time:

Event since timewindow