<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE lire:report-spec PUBLIC
  "-//LogReport.ORG//DTD Lire Report Specification Markup Language V2.0//EN"
  "http://www.logreport.org/LRSML/2.0/lrsml.dtd">
<lire:report-spec xmlns:lire="http://www.logreport.org/LRSML/"
 id="top-messages-by-period" superservice="syslog">

 <lire:title>Top Messages by Period Syslog Report </lire:title>

 <lire:description>
  <para>This report specification will generate a report showing the
   messages logged most often during each period. The
   number of messages to include as well as the period over which
   events are aggregated are configurable.
  </para>
 </lire:description>

 <lire:param-spec>
  <lire:param name="messages_to_show" type="int" default="10">
   <lire:description>
    <para>The number of messages to include for each period in the
     report.</para>
   </lire:description>
  </lire:param>

  <lire:param name="period" type="duration" default="1h">
   <lire:description>
    <para>The period used to aggregate the events.</para>
   </lire:description>
  </lire:param>
 </lire:param-spec>

 <lire:display-spec>
  <lire:title>Top $messages_to_show Messages by $period Period</lire:title>
 </lire:display-spec>

 <lire:report-calc-spec>
  <lire:timegroup period="$period" label="Period">

   <lire:group sort="-msg_count" limit="$messages_to_show">
    <lire:field name="message"/>

    <lire:count name="msg_count" label="Messages"/>
    <lire:count name="msg_ratio" ratio="table" label="% Total"/>
    <lire:count name="msg_group_ratio" ratio="group" label="% Period"/>
   </lire:group>
  </lire:timegroup>
 </lire:report-calc-spec>

</lire:report-spec>
