absent_over_time.md 517 B

% This is generated by ESQL's AbstractFunctionTestCase. Do not edit it. See ../README.md for how to regenerate it.

ABSENT OVER TIME

The absence of a field in the output result over time range.

Note: Available with the TS command in snapshot builds

TS k8s
| WHERE cluster == "prod" AND pod == "two"
| STATS events_received = max(absent_over_time(events_received)) BY pod, time_bucket = tbucket(2 minute)