How to correlate time-based events

[xhead]

I am gathering data from two different logging systems. Both have a user, event, and a log datetime. The logs are gathered on different machines and so may have slight differences in their system clocks and the events in both systems don't necessarily mean the same thing. (for example, a browser history log from a workstation and the IIS log from a web server)

I'm trying to answer the questions:

• What events occurred at about the same time for the same user?
• What events are recorded on one system for a user but not on the other system?

I'm not sure what "about the same time" is but it's probably within 5 seconds.

My first thought was to "round" the timestamps to the nearest "about" interval, like 0:00:00-0:00:05, 0:00:05-0:00:10, etc. This would group events in each log into 5-second intervals, but it wouldn't correlate an event logged in one source at 0:00:04 with an event logged on the other source at 0:00:06.

(It would be handy to have a "marker" event recorded in both logs, and use it to determine the clock difference between the two systems, but I don't think I have that).

It occurs to me that I guess I'd like to *cluster* events that happen within a certain fuzzy time interval.

Any ideas?

[v-ljerr-msft]

Hi @xhead,

I'm just wondering if you can convert your time columns to number of seconds first, then use ABS function in the filter of your calculation in this scenario? 

EventInBothTable=
CALCULATE (
    LOOKUPVALUE ( table2[event], table2[event], EARLIER ( table1[event] ) ),
    FILTER ( table2, ABS ( table2[time] - EARLIER ( table1[time] ) ) <= 5 )
)

Regards

[xhead · Accepted solution]

I like this idea.

I might massage it a bit because I think I'm not just correlating two events, but rather clustering multiple events that occur within the same time period. Anyway, your suggestion has allowed me to progress, thanks!

Mike