Sorry, I missed the question a few weeks back when you asked it.
The hard code above is as per the original problem statement. it would work fine with autorefresh - not quite realtime but close.
If you wanted a version specific to a real time search , it would probably be a little different, especially if the user was going to be selecting different time ranges. Don't change the overall time range if you want to keep that 12 hours of information. Just give them a shorter time they can poll across.
First, change the stats command in line 7 to streamstats window=12h. Add another streamstats for the new duration, XX, which you'll have to pass in as a parameter. Name all the fields using the same naming conventions, maybe MinHartXX and so on.
| streamstats window=12h
min(HeartRate) as MinHart12, min(RespirationRate) as MinResp12, min(BodyTemprature) as MinTemp12,
max(HeartRate) as MaxHart12, max(RespirationRate) as MaxResp12, max(BodyTemprature) as MaxTemp12
| streamstats window=1h
min(HeartRate) as MinHart01, min(RespirationRate) as MinResp01, min(BodyTemprature) as MinTemp01,
max(HeartRate) as MaxHart01, max(RespirationRate) as MaxResp01, max(BodyTemprature) as MaxTemp01
| streamstats window=$XX$
min(HeartRate) as MinHartXX, min(RespirationRate) as MinRespXX, min(BodyTemprature) as MinTempXX,
max(HeartRate) as MaxHartXX, max(RespirationRate) as MaxRespXX, max(BodyTemprature) as MaxTempXX
| stats
latest(MinHeart01) as MinHart01, latest(MinResp01) as MinResp01, latest(MinTemp01) as MinTemp01,
latest(MaxHeart01) as MaxHart01, latest(MaxResp01) as MaxResp01, latest(MaxTemp01) as MaxTemp01
latest(HeartRate) as CurHart, latest(RespirationRate) as CurResp, latest(BodyTemprature) as CurTemp
Then you're going to have to decode the new duration at the end into the field names/titles. Not sure of any elegant way to do that..
... View more