Hi all - looking for some help in analysis of machine data - specifically how long a machine has been in a specific Downtime Reason.
I want to be able to write an expression that sums Downtime Durations for a selected Downtime Reason, and subtract that from overall Downtime.
I can get such expressions to validate in the editor (example below) - but I don’t seem to get any valid answers from the expression - I just get the spinning wheel as Tulip appears to be calculating something - but no results.
I can use the ‘Filters’ section in analytics to look only specific Downtime Reason - but this is applied to the whole analytic, so can’t be used if I want to compare with Downtime overall.
So, is it possible to extract downtime durations for a specific downtime reason?
thanks for reaching out. There seems to be a little bug with regards to the evaluation of the condition in the SUMFILTERED function when using the downtime teasons. I have created a ticket to track that.
But I also have a solution you can use right now:
You can convert the downtime reason to a text and then do a simple string comparison to it. For that you’ll need the string-equivalent of your downtime reason. You can get this most easily by adding the following expression as a grouping to a Universal Template analysis filtered to a date range that includes the reason you are interested in.
From there, it is easy to get to your desired outcome (total downtime minus downtime for a specific reasion) subtracting the result from the total sum and filtering the whole analysis by something that removes non-downtime states. Depending on your setup this could be filtering on “Downtime Reason is not null” (as done in my example below), specifying the states you count as down or anything else.
Appreciate you taking the time to understand the issue, identify the workaround and give all the necessary detail for us to replicate.
For info on the bug ticket - the issue doesn’t seem limited the SUMFILTERED function - IF statements or even just simple conditions don’t see to like the use of the ‘purple’ selectable downtime reasons.