rate

The rate aggregation function returns the rate (based on _time) observed value of Expression across the group.

Use this function with the summarize, eventstats, and timestats operators.

Syntax

​

    rate( Expression, Time )

Arguments

​

• Expression: Expression used for aggregation calculation. Wildcards are not supported for field names.
• Time: Unit of time, specified with a positive integer and time period. Supports weeks ( w ), days ( d ), hours ( h ), minutes ( m ), and seconds ( s ). For example, one day would be 1d.

Example

​

dataset=myDataset
| summarize rate(goats, "5m")