Hello all, I have two sets of sensors, and want to display a line graph for each of the set of sensors over time, giving whether or not they detect anything. I have 4 different event types, an "on" and "off" for each of the sensor sets that tell when the sensors start detecting something (on) and when they stop detecting something (off). I would like a line graph with a line depicting each of the sensor sets, going between "on" and "off" for each line to show activity. As an example for what I'm trying / my thinking, I have this, though I'm getting an error with the streamstats command and recognize this implementation is likely far off. index=main (SM_C.key="PresenceMonitor.highConfidenceUsage" OR SM_C.key="PresenceMonitor.highConfidenceUsage.start" OR SM_C.key="RoomMonitor.Occupied" OR SM_C.key="RoomMonitor.UnOccupied") SM_C.value.data.room!="error" | streamstats eval(count(SM_C.key="RoomMonitor.Occupied") - count(SM_C.key="RoomMonitor.UnOccupied")) as A_in_use eval(count(SM_C.key="PresenceMonitor.highConfidenceUsage.start") - count(SM_C.key="PresenceMonitor.highConfidenceUsage")) as B_in_use | eval fan=mvrange(1, 2.0001) | mvexpand fan | eval Usage=case(fan=1,"A", fan=2,"B") | eval Value=case(fan=1,A_in_use, fan=2,B_in_use) | chart values(Value) by Usage The PresenceMonitor and the RoomMonitor are the two given sensor sets, with the occupied and start events giving the detection start (respectively) and the UnOccupied / Usage events giving the detection end (respectively). The use of mvexpand and case was an attempt to consolidate the 4 different events into 2 for charting the line graph. Thank you for any help! ... View more

I am attempting to create an alert based on a field calculated from all of the events of the search, specifically when it is less than some value. However, the alert solutions I've found thus far look to give alerts based on the count of events returned by the search, or filtering on a field of the events to determine the count of events that meet the filter. The calculated field I am interested in creating the alert on is not passed in any of the events. My search string for the alert is as follows (the search itself I've left out as I've already narrowed down to the events I am interested in): search ...filter... | eval device_duration = 0 | eval sensor_duration = 0 | convert num(SM_C.value.data.elapsedTime) as device_duration num(SM_C.value.data.time_active) as sensor_duration | stats sum(device_duration) as total_device_duration sum(sensor_duration) as total_sensor_duration | eval ratio = if((total_device_duration > total_sensor_duration), round((total_sensor_duration / total_device_duration), 2), round((total_device_duration / total_sensor_duration), 2)) | eval ratio = 100 * ratio The search is comparing events from 2 devices and getting the difference ratio between the sum of durations reported by each device's events. I'm looking to send an alert if the ratio falls below some threshold, say 70% (correlation drops below 70%). In the alert itself for the Trigger Conditions I have it set to a custom trigger "eval ratio < 70" but this does not cause the email. Please let me know what I'm doing wrong, or if there is a way to modify the search string to work on a different trigger condition. Thank you for any help! ... View more

Hello, I'm attempting to display three calculated fields (total_meeting_hours, total_use_no_meeting_hours, and hours_not_in_use) as a part of a pie chart. Each of these fields should represent a calculated portion of the total pie chart, with their values given on mouse over and their field names showing as their labels for their respective portions on the graph. I'm currently attempting to achieve this (seen below) by using mvappend to create a multi-value field (display_val) and then split on that field in the chart function. However when splitting by this field it displays the numeric time values for each of the fields instead of the field names (i.e "11.023" hour time instead of "total_meeting_hours"). How would I go about accomplishing this? I attempted to create a separate multi-value field and combine it with the other for labeling, but have so far been unable to do so. I'd greatly appreciate help! | convert num(SM_C.value.data.elapsedTime) as use_duration num(SM_C.value.data.MeetingElapsedTime) as meeting_duration | where (use_duration < 50000 and use_duration > 0) | eval meeting_duration = if(meeting_duration < use_duration, meeting_duration, meeting_duration = 0) | stats sum(use_duration) as total_duration sum(meeting_duration) as total_meeting_duration | eval total_meeting_hours = (total_meeting_duration / 60 / 60) | eval total_use_no_meeting_hours = (total_duration / 60 / 60) - total_meeting_hours | eval hours_not_in_use = (168) - (total_duration / 60 / 60) | eval display_val=(mvappend(hours_not_in_use, total_use_no_meeting_hours, total_meeting_hours)) | eval display_label=(mvappend("hours_not_in_use", "total_use_no_meeting_hours", "total_meeting_hours")) | mvexpand display_val | mvexpand display_label | chart eval(sum(display_val) / 168) as Percentage by display_val ... View more