events

Overlay events as markers on top of a time chart.

view events -o {
  id: 'string',
  title: 'string',
  typeField: 'fieldname',
  nameField: 'fieldname',
  messageField: 'fieldname',
  timeField: 'fieldname',
  on: 'sinkID',
  useMarkdown: 'true|false'
}

or

view events -id 'string' -title 'string'
  -typeField 'fieldname'
  -nameField 'fieldname' -messageField 'fieldname' -timeField 'fieldname'
  -on 'sinkID' -useMarkdown: 'true|false'

See Defining sink parameters for an explanation of how sink parameters can be expressed as object literals.

Parameter	Description	Required?
-id	An identifier for this sink that serves as a handle for referencing the object in Juttle syntax; conceptually identical to a variable name	No
-title	The title for the user-visible output, if it has one; the value may be any valid Juttle expression that produces a string	No; defaults to the name field that is present in all metrics points
-typeField	The name of a field in your data points that contains the class string of the icon to display. If your points don't already contain such a field, you must add one like this: ... | put type='fa-smile-o' ... Coming soon: support forFont Awesome class strings (such as "fa-git" for git events).	No; the default fieldname is "type", and if no "type" field is set then the default icon is an empty circle
-nameField	The field from which to source the title of the tooltip	No
-messageField	The field to source the text content of the tooltip	No
-timeField	The field containing the time stamp	No; defaults to the time field
-on	The ID of the time chart upon which to overlay events. See Overlaying events on time charts for information about overlaying charts.	No; when this option is omitted, events are displayed as a table
-useMarkdown	When this option is 'true', the values of the -nameField and the -messageField are parsed as markdown, allowing you to include links in your tooltips	No; the default is 'false'

Example: Overlay two series of "git merge" events on a time chart showing CPU load

const spiketime1 = :7 minutes before 2014-01-01:;
const spiketime2 = :3 minutes before 2014-01-01:;

reducer spike_cpu(valfield,hostname,time) {

    // workaround for PROD-5118, once its fixed we can remove this const redefinition
    const spiketime1 = :7 minutes before 2014-01-01:;
    const spiketime2 = :3 minutes before 2014-01-01:;

    var spike1 = 0;
    var spike2 = 0;
    var val = 0;

    function update() {
        if (*time > spiketime1) {
        spike1 = 1;
        }
        if (*time > spiketime2) {
        spike2 = 1;
        }
        if ((*hostname == "nyc.2") && spike1 != 0) {
        val = *valfield + 0.5;
        } else {
        if ((*hostname == "sea.0") && spike2 != 0) {
            val = *valfield + 0.2;
        } else {
            val = *valfield;
        }
        }
    }

    function result() {
        return val;
    }

}

read stochastic -source 'cdn' -nhosts 3 -from :10 minutes before 2014-01-01: -to :2014-01-01: -source_type 'metrics' name = 'cpu'
|filter name = 'cpu'
|put value=spike_cpu(value,host,time)
|  view timechart
     -valueField 'value'
     -keyField 'host'
     -yScales.primary.tickFormat '%'
     -title "% CPU busy on all hosts"
     -id 'CPU';

emit -limit 1 -from spiketime1
| put title = "title",type = "git",text = "Enable new CPU-consuming service in New York",label = "git merge"
| view events
    -on "CPU"
    -typeField "type"
    -timeField "time"
    -messageField "text"
    -nameField "label";

emit -limit 1 -from spiketime2
| put title = "title",type = "git",text = "Something that thrashes the CPU in Seattle",label = "git merge"
| view events
    -on "CPU" -typeField "type"
    -timeField "time"
    -messageField "text"
    -nameField "label";