The goal is to get concurrent users for each Revit model (file.name). How do I interpret records with empty file names?
FROM *revit-event*
| EVAL
// inconsistent RVT naming includes underscores and/or dashes
cleanFileName = REPLACE(file.name, "-", "_")
| KEEP @timestamp, `file.size(mb)`, user.name, computer.name, file.name, project.workset.open.count
// group by proj, file name, 5 minute interval:
| STATS concurrent_users = COUNT_DISTINCT(user.name), concurrent_computers = COUNT_DISTINCT(computer.name), fileSizeAverage = ROUND(AVG(`file.size(mb)`), 0), fileSizeDeviation = ROUND(MEDIAN_ABSOLUTE_DEVIATION(`file.size(mb)`)),openWorkSetAvg = ROUND(AVG(project.workset.open.count))
BY file.name, datestamp_minute = DATE_TRUNC(5 minute, @timestamp)
| WHERE concurrent_users > 1 AND fileSizeAverage > 1
| SORT file.name ASC, concurrent_users DESC
