How do I return values which have returned 1?

badgerfifteen — Wed, 21 Jan 2026 12:31:43 GMT

I have the following DQL code below:

timeseries interval: 10m, file_count = avg(filesystem.file_count, filter: { ( in(`dt.entity.filesystem:path`, classicEntitySelector("type(filesystem:path),entityName.equals(\"/link/link1/link2/test.csv\")"))) OR ( in(`dt.entity.filesystem:path`, classicEntitySelector("type(filesystem:path),entityName.equals(\"/link3/link4/test.1\")"))) }), by: { `dt.entity.filesystem:path` } | fieldsAdd entityName(`dt.entity.filesystem:path`) | sort arrayAvg(file_count) desc | filter arrayIndexOf(array(file_count), 1)

When using the line chart for the last 24 hours, this will display a line chart where it is mostly 0 and then around 18:00, jump up as the value has changed to 1 until 19:00.

I've tried using arrayIndexOf to filter to just 1, but it doesn't appear to work. Any ideas? How do I filter values or set a threshold to values which only appear as 1?

Re: How do I return values which have returned 1?

t_pawlak — Wed, 21 Jan 2026 13:18:54 GMT

Hi,

After timeseries, file_count is an array (time series), not a single value.
So arrayIndexOf() won’t work as expected.

Use iAny() to filter series that ever had value 1, and [] to work on points.
try change filters To keep only series that ever reached 1:

| filter iAny(file_count[] == 1)

To display only points where the value is 1

| fieldsAdd file_count = if(file_count[] == 1, file_count[], else: null)

try this example:

| filter iAny(file_count[] >= 1) | fieldsAdd file_count = if(file_count[] >= 1, file_count[], else: null)

it should keeps only series that hit the value 1

topic How do I return values which have returned 1? in DQL

How do I return values which have returned 1?

Re: How do I return values which have returned 1?