Siddhi Query : group by results

Question

I am having a trouble in digesting results of my group by query. My source stream named intermediateStream has data

     ts                       uid             id_resp_h
2016-05-08 08:59      CLuCgz3HHzG7LpLwH9    172.30.26.119
2016-05-08 09:00      C3WnnK3TgUf2cSzxVa    172.30.26.127 
2016-05-08 09:00      C3WnnK3TgUf2cSzxff    172.30.26.119

SIDDHI query is

from intermediateStream
select ts, count(ts) as ssh_logins
group by ts
insert into SSHOutStream;

I am expecting output to be like

        ts         ssh_logins
2016-05-08 08:59       1
2016-05-08 09:00       2

But instead it returns

        ts         ssh_logins
2016-05-08 08:59       1
2016-05-08 09:00       1
2016-05-08 09:00       2

Any suggestions?

score 1 · Accepted Answer · answered Jun 22 '16 at 12:02

Siddhi processes events in real time, as and when they arrive. Thus, in the given scenario, you get count = 1 for the second input since that is the only event with ts=2016-05-08 09:00 among the ones which have arrived so far. When the 3rd event arrives you get count=2, since the previous event too had same ts value.
To get the desired answer, use time batch window which allows you to wait till the specified time elapses prior to giving an output.
(i.e. from intermediateStream#window.timeBatch(1 min))

Siddhi Query : group by results

1 Answers1