As in the initial question, I want to derive a result in which the _time and b fields match. The spl attached below is also a field created in that context. ... View more

index=si-index-cbm type IN ("br-flag") | stats values(AMP) as AMP by _time, train_number, car_number, car | join type=left left=L right=R where L._time=R._time L.car_number=R.car_number [| search index=si-index-cbm type IN ("br-cur") | stats avg(data) as data by _time, train_number, car_number, car, key, ip, name, type, date] or index=si-index-cbm type IN ("br-flag") | stats values(AMP) as AMP by _time, train_number, car_number, car | join _time, car_number [| search index=si-index-cbm type IN ("br-cur") | stats avg(data) as data by _time, train_number, car_number, car, key, ip, name, type, date] I want to use those codes, but it doesn't work ... View more

thanks for good answer However, if the current SPL is used, the code does not start at the value above 80, but the code occurs before when it becomes less than 80. Can this be solved? Since the data is different based on the car, the current spl is as follows. | streamstats window=2 current=f earliest(data) as previous_data by car | eval err=if(data>80 AND previous_data <=80, code, "")   ... View more