view release on metacpan or  search on metacpan

doc/recs-normalizetime.pod  view on Meta::CPAN

 current representative value then the prior record value will be used
 
 So if the threshold is 60 seconds then the following record stream would be produced
 
 date      n_date
 1:00:00   1:00:00
 1:00:59   1:00:00
 1:02:05   1:02:00
 1:02:55   1:02:00
 1:03:15   1:02:00     ** Note - still matches prior representative value               **
 1:05:59   1:05:00
 1:06:15   1:05:00     ** Note - matches prior entry                                    **
 1:07:01   1:07:00     ** Note - since the 1:05 and 1:06 had the same representative    **
 ** value then this is considered a new representative time slice **
 
 Basically a 60 second threshold will match the current minute and the next minute unless
 the prior minute was seen and then the 60 second threshold matches the current minute and
 the prior minute.
 
 
 Example usage: if you have log records for "out of memory" exceptions which may occur multiple
 times because of exception catching and logging then you can distill them all down to a
 single logical event and then count the number of occurrences for a host via:
 
 grep "OutOfMemory" logs |
       recs-frommultire --re 'host=@([^:]*):' --re 'date=^[A-Za-z]* (.*) GMT ' |
     recs-normalizetime --key date --threshold 300 | 
   recs-collate --perfect --key n_date -a firstrec | 
 recs-collate --perfect --key firstrec_host -a count=count
 
 
 Help from: --help-keyspecs:
   KEY SPECS
    A key spec is short way of specifying a field with prefixes or regular
    expressions, it may also be nested into hashes and arrays. Use a '/' to nest
    into a hash and a '#NUM' to index into an array (i.e. #2)
 
    An example is in order, take a record like this:
 
      {"biz":["a","b","c"],"foo":{"bar 1":1},"zap":"blah1"}
      {"biz":["a","b","c"],"foo":{"bar 1":2},"zap":"blah2"}
      {"biz":["a","b","c"],"foo":{"bar 1":3},"zap":"blah3"}
 
    In this case a key spec of 'foo/bar 1' would have the values 1,2, and 3 in
    the respective records.
 
    Similarly, 'biz/#0' would have the value of 'a' for all 3 records
 
    You can also prefix key specs with '@' to engage the fuzzy matching logic
 
    Fuzzy matching works like this in order, first key to match wins
      1. Exact match ( eq )
      2. Prefix match ( m/^/ )
      3. Match anywehre in the key (m//)
 
    So, in the above example '@b/#2', the 'b' portion would expand to 'biz' and 2
    would be the index into the array, so all records would have the value of 'c'
 
    Simiarly, @f/b would have values 1, 2, and 3
 
    You can escape / with a \. For example, if you have a record:
    {"foo/bar":2}
 
    You can address that key with foo\/bar
 

=head1 SEE ALSO

=over

=item * See L<App::RecordStream> for an overview of the scripts and the system

=item * Run C<recs examples> or see L<App::RecordStream::Manual::Examples> for a set of simple recs examples

=item * Run C<recs story> or see L<App::RecordStream::Manual::Story> for a humorous introduction to RecordStream

=item * Every command has a C<--help> mode available to print out usage and
examples for the particular command, just like the output above.

=back