Explore Advanced Time-Series Analysis Using DQL

henk_stobbe — Wed, 17 Dec 2025 12:04:40 GMT

Hello,

(and yes I know you can use -1 as default, but this is more fun)

As an example:

timeseries def1=count(dt.host.cpu.load,default:1),{def2=count(dt.host.cpu.load,default:0)}| fieldsadd Result = def1[] - def2[] | fieldsRemove def1,def2

Show me when I have no timeseries

or:

timeseries def1=count(dt.host.cpu.load,default:1),{def2=count(dt.host.cpu.load,default:0)}| fieldsadd Result = def2[] - def1[] +1 | fieldsRemove def1,def2

Show me when I have timeseries:

Maybe this van inspire someone

KR Henk

topic Explore Advanced Time-Series Analysis Using DQL in DQL

Explore Advanced Time-Series Analysis Using DQL