0

I have been using following siddhi query to get the events count per minute; ts as timestamp (string) and ftp_requests as count (int).

from FTPInStream[command == 'USER']
select time:timestampInMilliseconds(time:dateAdd(str:replaceAll(ts,'T',' '), 5, 'hour',"yyyy-MM-dd HH:mm:ss"),'yyyy-MM-dd HH:mm') as milliseconds , uid, id_orig_h, id_orig_p, id_resp_h, id_resp_p
insert into intermediateStream;

from intermediateStream#window.externalTimeBatch( milliseconds ,1 min, milliseconds, 1 min)
select time:dateFormat(milliseconds, 'yyyy-MM-dd HH:mm' ) as ts , cast(count(milliseconds), 'int') as ftp_requests
group by milliseconds
insert into FTPOutStream;

If I want to add previous value of ftp_requests in each new value to get the accumulative number of requests with each new requests, what change would be required? Is there any function in siddhi to get the previous event value from stream that has already been published?

Community
  • 1
  • 1
aneela
  • 1,457
  • 3
  • 24
  • 45

1 Answers1

0

You shouldn't be using group by milliseconds, and count() should not require any params, as well as it doesn't need to be cast in to int. Try the following query.

from FTPInStream[command == 'USER']
select time:timestampInMilliseconds(time:dateAdd(str:replaceAll(ts,'T',' '), 5, 'hour',"yyyy-MM-dd HH:mm:ss"),'yyyy-MM-dd HH:mm') as milliseconds , uid, id_orig_h, id_orig_p, id_resp_h, id_resp_p
insert into intermediateStream;

from intermediateStream#window.externalTimeBatch( milliseconds ,1 min, milliseconds, 1 min)
select time:dateFormat(milliseconds, 'yyyy-MM-dd HH:mm:ss' ) as ts , count() as ftp_requests
insert into FTPOutStream;
Grainier
  • 1,634
  • 2
  • 17
  • 30