Hi all. I'm facing some issues in displaying annotations for my graphs. I suspect that something is wrong when I use 2 STREAMSTATS command. My annotation for that particular graph seems to stop working.
When I run this code, it works!
| streamstats avg(alarmcount) as average stdev(alarmcount) as standev
| eval threeSigmaLimit = (average + (standev * 3))
| where alarmcount > threeSigmaLimit | eval annotationlabel = index | eval annotationcolor = "0xff9900"
| table time annotationlabel alarmcount
However, when I run this code. The annotation disappears.
| streamstats window=2 min(alarmcount3) as minimum
| eval isincrease=if(alarmcount3!=minimum,1,0)
| streamstats window=7 sum(isincrease) as increases
| where increases>=7
| eval increaseindex = index2 - 6
| eval annotationlabel = increaseindex| eval annotationcolor = "0xff9900"
| table time annotationlabel alarmcount3
any idea whY??
Don't run your search completely but try running it part by part so that you can find which part of your search is going wrong.
Yup! I did. I realised that if I remove the '2nd' streamstats command, everything works. Hmmm... I really think that it isn't the code that has a problem here..