Run analysis
Evaluates an analysis configured in the event type against the current event and exposes the result to the following conditions.
| Configuration | Content |
|---|---|
| Analysis | analysis existing in the event type |
| Setting: Result | name under which the result becomes available; default: the analysis name |
| Destination | fields that receive each reading (all optional) |
The result becomes available as a temporary variable, with five attributes:
| Attribute | Label in the panel | Content |
|---|---|---|
score | Score | calculated score |
score_cell | Score cell | cell the score came from |
triggered | Triggered | whether the analysis was triggered |
triggered_count | Triggered cell count | how many cells were triggered |
triggered_cells | Triggered cells | names of the triggered cells |
Condition 1: $amount > 0 → Run analysis: bot
Condition 2: %bot.triggered_count >= 2 → Set field: review = "true"
Condition 3: "email_velocity" in %bot.triggered_cells → Add to list: $user_email to @blocked_emails
Beyond those five attributes, each evaluated cell publishes the raw value it measured in the window, under %<result>.cells.<cell>.value. A cell with no trigger delivers its number through this variable, which is equally available to the other cells.
The Destination fields are optional and serve to persist a reading in the event, making it queryable in metrics and monitors. Like every temporary variable, the result itself is not written. When persisting Triggered cells, the names are written to a single text field, separated by commas.
An additional target, Version, writes which version of the analysis evaluated the event. Persisting this reading is what makes it possible, later, to separate the events decided by one version from those decided by the next.
The result name only needs to be provided when the same rule runs the same analysis twice: each run is its own result and needs a distinct name.
This action only reads: it does not feed the analysis’s windows. To feed them, use record analysis.