sliding_window_counts plugin

Learn how to use the sliding_window_counts plugin to calculate counts and distinct counts of values in a sliding window over a lookback period.

Calculates counts and distinct count of values in a sliding window over a lookback period, using the technique described in the Perform aggregations over a sliding window example. The plugin is invoked with the evaluate operator.

Syntax

T | evaluate sliding_window_counts(IdColumn, TimelineColumn, Start, End, LookbackWindow, Bin , [dim1, dim2, …])

Parameters

NameTypeRequiredDescription
Tstring✔️The input tabular expression.
IdColumnstring✔️The name of the column with ID values that represent user activity.
TimelineColumnstring✔️The name of the column representing the timeline.
Startint, long, real, datetime, or timespan✔️The analysis start period.
Endint, long, real, datetime, or timespan✔️The analysis end period.
LookbackWindowint, long, real, datetime, or timespan✔️The lookback period. This value should be a multiple of the Bin value, otherwise the LookbackWindow will be rounded down to a multiple of the Bin value. For example, for dcount users in past 7d: LookbackWindow = 7d.
Binint, long, real, datetime, timespan, or string✔️The analysis step period. The possible string values are week, month, and year for which all periods will be startofweek, startofmonth, startofyear respectively.
dim1, dim2, …stringA list of the dimensions columns that slice the activity metrics calculation.

Returns

Returns a table that has the count and distinct count values of Ids in the lookback period, for each timeline period (by bin) and for each existing dimensions combination.

Output table schema is:

TimelineColumndim1..dim_ncountdcount
type: as of TimelineColumn......longlong

Example

Calculate counts and dcounts for users in past week, for each day in the analysis period.

let start = datetime(2017 - 08 - 01);
let end = datetime(2017 - 08 - 07); 
let lookbackWindow = 3d;  
let bin = 1d;
let T = datatable(UserId: string, Timestamp: datetime)
    [
    'Bob', datetime(2017 - 08 - 01), 
    'David', datetime(2017 - 08 - 01), 
    'David', datetime(2017 - 08 - 01), 
    'John', datetime(2017 - 08 - 01), 
    'Bob', datetime(2017 - 08 - 01), 
    'Ananda', datetime(2017 - 08 - 02),  
    'Atul', datetime(2017 - 08 - 02), 
    'John', datetime(2017 - 08 - 02), 
    'Ananda', datetime(2017 - 08 - 03), 
    'Atul', datetime(2017 - 08 - 03), 
    'Atul', datetime(2017 - 08 - 03), 
    'John', datetime(2017 - 08 - 03), 
    'Bob', datetime(2017 - 08 - 03), 
    'Betsy', datetime(2017 - 08 - 04), 
    'Bob', datetime(2017 - 08 - 05), 
];
T
| evaluate sliding_window_counts(UserId, Timestamp, start, end, lookbackWindow, bin)

Output

TimestampCountdcount
2017-08-01 00:00:00.000000053
2017-08-02 00:00:00.000000085
2017-08-03 00:00:00.0000000135
2017-08-04 00:00:00.000000095
2017-08-05 00:00:00.000000075
2017-08-06 00:00:00.000000022
2017-08-07 00:00:00.000000011