<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE lire:report-spec PUBLIC
  "-//LogReport.ORG//DTD Lire Report Specification Markup Language V1.0//EN"
  "http://www.logreport.org/LRSML/1.0/lrsml.dtd">
<lire:report-spec xmlns:lire="http://www.logreport.org/LRSML/"
 id="top-processes-by-period" superservice="syslog">

 <lire:title>Top Processes by Period Syslog Report </lire:title>

 <lire:description>
  <para>This report specification will generate a report showing the
   processes that logged the most messages during each period. The
   number of process to include as well as the period over which
   events are aggregated are configurable.
  </para>
 </lire:description>

 <lire:param-spec>
  <lire:param name="processes_to_show" type="int" default="10">
   <lire:description>
    <para>The number of processes to include for each period in the
     report.</para>
   </lire:description>
  </lire:param>

  <lire:param name="period" type="duration" default="1h">
   <lire:description>
    <para>The period used to aggregate the events.</para>
   </lire:description>
  </lire:param>
 </lire:param-spec>

 <lire:display-spec>
  <lire:title>Top $processes_to_show Processes by $period Period</lire:title>
 </lire:display-spec>

 <lire:report-calc-spec>
  <lire:timegroup period="$period">
   <lire:count name="msg_by_period"/>
   <lire:group sort="-msg_count" limit="$processes_to_show">
    <lire:field name="process"/>
    <lire:count name="msg_count"/>
   </lire:group>
  </lire:timegroup>
 </lire:report-calc-spec>

</lire:report-spec>
