Episode fields

Follow severity and lifecycle changes. Observation fields qualify when a condition began or cleared.

Field	Type	Unit	Meaning
sparklogs.episode.id	string		Unique episode ID, retained throughout the condition's lifecycle.
sparklogs.episode.event_seq	integer	count	Counts this episode's events from 1. Survives an agent restart, so a consumer can tell whether an event is newer than what it holds without trusting a clock.
sparklogs.episode.occurrence	integer	count	Which time this is that the condition has opened on this subject on this agent. Counted locally and kept across a reinstall; a wiped host resets it.
sparklogs.episode.phase	string		Where the episode stands: onset, held, recovering, recovered or ended.
sparklogs.episode.transition	string		Lifecycle change: opened, recovering, relapsed, closed, ended, severity_raised or severity_lowered. Absent without a transition.
sparklogs.episode.first_observed_ts	string	timestamp	When the episode opened.
sparklogs.episode.age_basis	string		onset: start watched live. observed: already present when first noticed, making age a lower bound. unknown_ongoing: no meaningful onset time.
sparklogs.episode.last_confirmed_ts	string	timestamp	The last time an observed reading found the condition still true, on a rung or held there by its hold level. A reading that could not tell, one below the ladder, or one at its exit does not move it.
sparklogs.episode.max_observation_gap_s	integer	seconds	Longest single span, in seconds, the condition went unobserved between two observed readings that placed it: asleep, not capturing, or read without a usable reading.
sparklogs.episode.observed_s	integer	seconds	Seconds since the episode opened that the agent was observing: awake and capturing, outside low-power idle and the settle after a resume. Episodes opened before 1.13.0 count their earlier time from the older agent's observed age, an upper bound.
sparklogs.episode.unobserved_s	integer	seconds	Seconds since the episode opened that nobody observed: asleep, in low-power idle or its settle, not capturing, or across an agent restart. With observed_s it adds up to the time since first_observed_ts, within one capture interval.
sparklogs.episode.last_observed_ts	string	timestamp	When an observed reading last placed the condition, on a rung, below it or at its exit. Unlike last_confirmed_ts, a reading below the ladder or at its exit moves this too.
sparklogs.episode.post_gap_s	integer	seconds	Total unobserved seconds in the interval preceding this event (may span several gaps); present when at least 30 s.
sparklogs.episode.presence_seen_count	integer	count	Samples containing this subject during its tracked lifetime. Present only with presence_observed_count, the denominator.
sparklogs.episode.presence_observed_count	integer	count	Samples in which this subject could have been observed. Denominator for presence_seen_count.
sparklogs.episode.recovery_attempts	integer	count	Number of recovery attempts during this episode. An attempt does not establish that recovery completed.
sparklogs.episode.recovering_total_s	integer	seconds	How long, in total observed time, the episode has spent recovering.
sparklogs.episode.last_transition_ts	string	timestamp	When this episode last emitted a transition, whatever it was. Answers how long it has been at this severity without scanning its other events.
sparklogs.episode.peak_severity	integer		The highest severity this episode has carried, as the SparkLogs integer level (the scale thresholds bars use for severity), so one closing event can say it peaked here and lasted this long. The integer form starts in 1.13.0; agents 1.11.2 through 1.12.x sent the lowercase severity name.
sparklogs.episode.pending_transition	string		The transition a debounce window is currently accumulating toward. Present only while one is running, and what explains readings sitting under the severity the episode still asserts.
sparklogs.episode.pending_since_ts	string	timestamp	When the running debounce window started holding. Rides with the transition it is accumulating toward or not at all.
sparklogs.episode.replaced_id	string		The episode this one superseded, linking a chain where one condition gave way to another on the same subject. Only episodes opened before 1.13.0 carry it.
sparklogs.episode.cleared_ts	string	timestamp	When the condition stopped being true. Closure only.
sparklogs.episode.clear_time_basis	string		observed: the agent watched the condition clear; every recovery carries it. unobserved_gap: only on an administrative ended closure, whose time is clamped back to the last confirmation.
sparklogs.episode.end_reason	string		Why tracking stopped rather than why the condition cleared, for an episode that ended without recovering. subject_removed: the subject went away. detector_disabled, module_removed, condition_removed: the condition was turned off or retired. evidence_unreadable: the input it decides on kept failing to read. no_longer_applicable: the condition stopped applying to the subject for its exit dwell, such as a network adapter that disconnected.
sparklogs.episode.input_topics	string_array		The topics whose captures the condition decides on, its own topic first.
sparklogs.episode.thresholds	object		What this report measured, so one event stands alone. legs: one per field the condition decides on, each with field, kind (threshold, flag, one_of or custom), value when measured, unit, deciding, and clock (wall or observed) only when the value itself grows with time. A count over a trailing window adds window_s and window_clock. A threshold leg lists bars in order: enter, each escalate from mildest to worst, then clear; each bar has kind, op, value in the leg's unit, and severity (the unclamped level reached) except on clear; when several legs carry a bar at one severity, each of those bars has combine (all or any), the same on all of them. A flag leg has opens_when; a one_of leg has opens_in when a rung names the opening codes and clears_in when the exit names the recovering codes, both in the codes value uses. custom legs are plain facts. A leg that counts discrete events can add counts: reason, the occurrence reason whose events the count covers, with instance, the counted events' sparklogs.instance, when they are this episode's subject's (no instance means every event of that reason on the device); and last_ts, when the newest counted event happened, present while value is above zero. Occurrence events go back only as far as the reason's lookback, and are sent only while the pack keeps that occurrence on, so there can be fewer of them than the count says. A count of Windows events the agent reads itself carries event_reasons in place of reason: always a list, the reason codes the source pack gives those events' log rows, which can also cover events the count leaves out. lql_filter, when present, is an LQL expression that narrows those log rows to the counted events, to be ANDed, parenthesized, with the reason, instance and time scope, never in place of it. Some of those events, such as out-of-memory crashes, are also reported as a broader occurrence. clear_combine (all or any) appears when several legs own recovery. dwell (toward, elapsed_s, required_s, clock: observed) appears while a debounce window runs. held_escalation (from, band, after_s, elapsed_s) appears on a condition that rises from severity from to band after holding from or worse for after_s observed seconds; elapsed_s is the observed time held there so far, 0 while under from. Show it as time held toward band, never as a projected time. held_escalations carries the same progress objects for multiple targets sharing one held clock; it replaces the singular object only for a multi-target condition.