match split

The match split operation is identical to the match operation except it finds all occurrences instead of just the first occurrence. It is analogous to match all in regular expressions.

Syntax

match split {<match pattern>}
  {if <match condition>}


<match pattern> = <state 1> >> <state 2> >> ...
<match condition> = <condition 1> and <condition 2> and ...
<state> = {<tag name>}({<event name include/exclude list>}){<quantifier>}
<event name include list> = <event name 1>|<event name 2>|...
<event name exclude list> = ^<event name 1>,<event name 2>,...
<quantifier> uses regular expression syntax = ONE OF
  *     - match zero or more times
  +     - match one or more times
  ?     - match zero or one time
  {n}   - match exactly n times
  {n,}  - match at least n times
  {n,m} - match from n to m times

For further details on syntax, see the match reference page.

How it works

match split does the following, in order:

• Find the first match the same way as match does
• Continue looking for the second match starting from the event immediately after the first match (i.e., overlapping matches are not allowed)
• Continue finding matches until the end of a sequence
• Split sequences BEFORE each match
• Define the PREFIX and SUFFIX tags:
  • PREFIX tag is assigned to the events before the first match, which becomes its own subsequence split. The first match marks the start of the second split.
  • SUFFIX tag is assigned to the events after each match. This means SUFFIX effectively marks the events between the different matches as well as after the last match, and that every split (potentially) contains a SUFFIX tag.
• Transfer existing sequence dimensions to all split sequences
• Add split_index and split_count sequence dimensions:
  • split_count is the total number of splits, and has the same value for all splits.
  • split_index is the index of the split running from 0 to split_count - 1, with PREFIX tag (if present) receiving a split_index value of 0.

Examples

Split sequences before event

match split event1
filter MATCHED

Split sequences after event

match split * >> event1
filter MATCHED

(sessionization) Split sequences on a time gap between events

match split Session()+
if duration(Session[-1], SUFFIX[0]) > 1h

Split sequences by date

match split A()+
if date(A[-1]) != date(SUFFIX[0])

Match all events starting with a given string in the name

match split Event()
if Event.name like 'string%'

Match all events ending with a given string in the name

match split Event()
if Event.name like '%string'

Match all events containing a given string in the name

match split Event()
if Event.name like '%string%'

Match all events by regex pattern in the name

match split Event()
if Event.name similar to 'regular_expression_pattern'

Split sequences when a dimension value changes

match split Session()+
if Session[-1].dimension != SUFFIX[0].dimension

Keep last instance of a consecutive repeated event

match split A(event){2,}
replace A with A[-1]
combine