Run analysis

Evaluates an analysis configured in the event type against the current event and publishes the result to the following conditions.

Configuration	Content
Analysis	analysis existing in the event type
Setting: Result	name under which the result is published; default: the analysis name

The result is published as a temporary variable, with the keys listed under Published keys:

Key	Label in the panel	Content	Presence
score	Score	calculated score	when the run evaluates at least one score cell, even with a zero value
score_cell	Score cell	cell the score came from	when the run assigns the event to a cell
triggered	Triggered	whether any cell triggered	always
triggered_count	Triggered cell count	how many cells triggered	always; zero triggers is a reading, not an absence
triggered_cells	Triggered cells	names of the triggered cells	always; empty when no cell triggers
version	Version	version of the analysis that ran	always

Condition 1:  $amount > 0                          → Run analysis: bot
Condition 2:  %bot.triggered_count >= 2            → Set field: review = "true"
Condition 3:  "email_velocity" in %bot.triggered_cells  → Add to list: $user_email to @blocked_emails

Under the Cells heading, the list also shows one key per cell of the analysis, %<result>.cells.<cell>.value, with the raw value the cell measured in the window. The action does not publish this key when the cell is not evaluated. A cell with no trigger delivers its number through this key, equally available to the other cells.

Writing to the event

The action writes nothing into the event. To make a reading queryable in metrics and monitors, add a set field after the action, as described in Published results. The triggered_cells set is written into a text field with join:

Set field: bot_cells = join(%bot.triggered_cells, ",")
Set field: bot_version = %bot.version

Writing the version key separates, later, the events decided by one version of the analysis from those decided by the next. A rule that wrote the version through the former Version destination no longer fills in that field. To fill it in again, add a set field with %<result>.version, as in the example above.

Result name

The result name only needs to be provided when the same rule runs the same analysis twice. Each run is its own result, and the result name is unique within the rule.

This action only reads: it does not feed the analysis’s windows. To feed them, use record analysis.