Occurrence fields

The discovery lookback bounds what a missing occurrence can tell you about past activity.

Field	Type	Unit	Meaning
sparklogs.occurrence.lookback_d	integer	days	Discovery lookback in days. Absence says nothing about occurrences before this period.
sparklogs.occurrence.recorded_evidence	object_array		Exact selectors for independently recorded events of the same transition, on lifecycle occurrences: host_booted cites the kernel's boot start record, host_unexpected_shutdown the event log's unexpected-shutdown record and the kernel's unclean-reboot record. A record is cited only when it is the one of its kind between the last time the agent knew the previous boot alive and this agent's start. A sleep cites the records written inside its span, up to four: host_sleep_entered the kernel's sleep-entry record (Kernel-Power 42) and the first Modern Standby entry record (506), host_sleep_exited the kernel's resume time changes (Kernel-General 1), its boot-type record (Kernel-Boot 27) and the last Modern Standby exit record (507). A lifecycle row rebuilt from the System log (basis: recorded) cites the records it was rebuilt from: a boot its Kernel-General 12, Kernel-Boot 27 and EventLog 6005; a shutdown its Kernel-General 13 and EventLog 6006, or for Fast Startup its Kernel-Power 42; a Fast Startup boot its Kernel-Boot 27; an unexpected shutdown its EventLog 6008 and Kernel-Power 41. Each entry has original UTC RFC3339 t, match_fields (subsource, origin, event_id, positive signed record_id) and association: inferred_same_transition. Absent when no such record was found; a referenced original may be unavailable in stored events.
sparklogs.occurrence.recorded_evidence[].t	string	timestamp	In each recorded_evidence entry.
sparklogs.occurrence.recorded_evidence[].match_fields	object		In each recorded_evidence entry.
sparklogs.occurrence.recorded_evidence[].association	string		In each recorded_evidence entry.
sparklogs.occurrence.recorded_evidence_truncated	bool		True when valid recorded-event selectors exceeded the four-object or 16 KiB attachment limit. Absent otherwise.
sparklogs.occurrence.basis	string		On every lifecycle occurrence: how the transition is known. observed when the agent saw it happen or read it at its own start; recorded when it was rebuilt from the System log for a span the agent did not watch (each such row cites its records in recorded_evidence), as config_change.basis uses the word. Absent on other occurrences.