Splunk Add-on for Cisco UCS: Trouble with returning only active alerts

[mrandolph12]

I'm trying to display a dashboard of all current alarms in my Cisco UCS environment. I'm having trouble comparing events to test if the event was cleared or if it's still active. I can only determine this if I get an event that indicates an alarm was triggered and an event that indicates that alarm was cleared. I need to match multiple fields to make sure I'm comparing apples to apples and dismiss the alarms that have already cleared. Here's where I'm stuck at:

index=cisco-ucs source=cisco:ucs:faultInst ((highestSeverity="critical" AND severity="critical") OR (highestSeverity="critical" AND severity="cleared"))
    | eval alarm1_Severity=if((highestSeverity="critical" AND severity="critical"), severity, null())
    | eval alarm1_Time=if((highestSeverity="critical" AND severity="critical"), lastTransition, null())    
    | eval alarm2_Severity=if((highestSeverity="critical" AND severity="cleared"), severity, null())
    | eval alarm2_Time=if((highestSeverity="critical" AND severity="cleared"), lastTransition, null())    
    | transaction fields="dn" maxspan=1s
    | eval alarmCleared=if(alarm1_Time<alarm2_Time, "Cleared", "Active")
    | search alarmCleared="Active"    

Sample events:

created="2019-11-03T04:29:42.320",tags="server",dn="sys/rack-unit-10/health-led/fault-F1236",rule="equipment-health-led-critical-error",origSeverity="critical",prevSeverity="critical",occur="1",ack="no",lastTransition="2019-11-03T05:16:49.211",highestSeverity="critical",lc="",descr="sys/rack-unit-10/health-led shows error. Reason FP_TEMP_SENSOR:Temperature Threshold Crossed; ",severity="cleared",type="equipment",id="15490158",cause="health-led-amber-blinking",code="F1236",changeSet="",site="",system_name="MYHOST",address="10.2.1.120" 


created="2019-11-03T04:29:42.320",tags="server",dn="sys/rack-unit-10/health-led/fault-F1236",rule="equipment-health-led-critical-error",origSeverity="critical",prevSeverity="critical",occur="1",ack="no",lastTransition="2019-11-03T04:29:42.320",highestSeverity="critical",lc="",descr="sys/rack-unit-10/health-led shows error. Reason FP_TEMP_SENSOR:Temperature Threshold Crossed; ",severity="critical",type="equipment",id="15490158",cause="health-led-amber-blinking",code="F1236",changeSet="",site="",system_name="MYHOST",address="10.2.1.120"