Hi all. I'm facing some issues in displaying annotations for my graphs. I suspect that something is wrong when I use 2 STREAMSTATS command. My annotation for that particular graph seems to stop working.
When I run this code, it works!
index="alarm"
| streamstats avg(alarmcount) as average stdev(alarmcount) as standev
| eval threeSigmaLimit = (average + (standev * 3))
| where alarmcount > threeSigmaLimit | eval annotation_label = index | eval annotation_color = "0xff9900"
| table _time annotation_label alarmcount $field1.earliest$ $field1.latest$
However, when I run this code. The annotation disappears.
index="alarm"
| streamstats window=2 min(alarmcount3) as minimum
| eval is_increase=if(alarmcount3!=minimum,1,0)
| streamstats window=7 sum(is_increase) as increases
| where increases>=7
| eval increase_index = index2 - 6
| eval annotation_label = increase_index| eval annotation_color = "0xff9900"
| table _time annotation_label alarmcount3 $field1.earliest$ $field1.latest$
any idea whY??
↧