Slice Run telemetry for targeted analysis

After completing this workflow, you can turn a section of existing telemetry in Explore into an ad hoc Run.

Before you begin

Identify the Asset or Run with the telemetry you want to use, and the time range within it you want to turn into a new Run, referred to as an ad hoc Run.
To create an ad hoc Run using the API, you also need a Sift API key and your base URLs, and the ID of each Asset you want to include.

How ad hoc Runs work

An ad hoc Run is a Run created from a segment of historical data in a Time Series Panel in Explore. Ad hoc Runs let you perform diagnostic zooming or event isolation by stripping out unrelated noise. For an explanation on how ad hoc Runs differs from Runs, see Runs and ad hoc Runs.

Historical data only: You can’t create an ad hoc Run from a live stream.

Create an ad hoc Run

In Explore, open a Time Series Panel and plot one Channel from an Asset or Run.
Optional. To include more than one Asset or Run, click Select data, open the Assets or Runs tab, select the additional Assets or Runs, and select Update.
Click Select X in the toolbar.
Select X is disabled in live mode.
Click and drag over the time range you want the Run to cover.
Right-click the selection and select Create Run.
Create Run is disabled unless the Panel is in Absolute/UTC time alignment.
Enter a name for the Run.
Optional. Enter a description for the Run.
Select Create.

Call CreateAdhocRun with name, description, start_time, stop_time, and asset_ids. All five are required, and start_time must be before stop_time. start_time and stop_time use RFC 3339 format, for example 2024-05-26T13:59:28.569Z.
curl
curl -X POST -H "Authorization: Bearer $API_TOKEN" -H "Content-Type: application/json" $SIFT_REST_URL/api/v2/runs:adhoc -d '{ "name": "YOUR_AD_HOC_RUN_NAME", "description": "YOUR_AD_HOC_RUN_DESCRIPTION", "startTime": "2024-05-26T13:59:28.569Z", "stopTime": "2024-05-26T14:02:52.232Z", "assetIds": ["YOUR_ASSET_ID", "YOUR_OTHER_ASSET_ID"] }'
Client keys: client_key is an optional parameter on CreateAdhocRun that lets you assign your own unique identifier to the Run. It’s recommended because it makes querying the Run more convenient later. It can only be set once, at creation or on the first update.

Verify

Open the new ad hoc Run and confirm:

Name: shows the name you gave it.
Data: returns data from the selected Asset(s) within the time range you defined.
Availability: appears as a data source you can add to the current investigation or navigate to directly.

In the CreateAdhocRun response, confirm run.runId is populated and run.isAdhoc is true.

Reference

Runs and ad hoc Runs

Get started

Ingest telemetry

Investigate

Detect and review

Transform

Export

Sift CLI

Integrate

Manage workspace

Reference

Slice Run telemetry for targeted analysis

Before you begin

How ad hoc Runs work

Create an ad hoc Run

Verify

Reference

​Before you begin

​How ad hoc Runs work

​Create an ad hoc Run

​Verify

​Reference

Before you begin

How ad hoc Runs work

Create an ad hoc Run

Verify

Reference