Query

The Query page lets you explore the time-series data Pulse collects from your OPC UA nodes and S7 tags. Instead of looking at a single monitor, you build an ad-hoc query — pick the data points, choose how to aggregate them, and see the result as charts or a table.

This is read-only analysis. Queries never change your monitors, thresholds, or incidents.

How a query is built

A query is assembled in the Define panel from three parts, shown side by side:

• SELECT — the aggregations to compute (e.g. average, maximum, a percentile).
• WHERE — the data points to include (the OPC UA nodes and S7 tags).
• GROUP BY — how to split the results into separate series.

The time range and granularity are set from the clock icon in the panel header. Press Run Query to execute, or Cancel to clear the current results.

SELECT — aggregations

Each aggregation reduces all the readings in a time bucket to a single number. You can add up to four aggregations to one query.

An aggregation is a function applied to a field:

• Functions — Count, Sum, Average, Min, Max, and percentiles (P1, P5, P10, P25, P50/median, P75, P90, P95, P99, and finer steps such as P0.1 and P99.9).
• Fields — the value being aggregated:
  • Value — the numeric reading from the node or tag. Boolean tags count as 0 or 1.
  • Latency — how long the read took, in milliseconds. Useful for spotting slow or degrading connections.

Count does not need a field — it counts the number of samples in each bucket.

To add an aggregation, start typing a function name. Type the function followed by ( to choose a field — for example avg( then pick Value or Latency. The result reads back as a chip like avg(value) or max(latency).

TIP

Only successful reads are included. A reading is counted only when the source reported a good status (OPC UA status Good, S7 read status OK). Failed or stale reads are excluded, so the aggregates reflect healthy data only.

WHERE — data points

The WHERE field selects which nodes and tags feed the query.

Start typing an endpoint name to find it, then type / to drill into its nodes or tags. Pick a specific node/tag, or choose the * wildcard to include every child of that endpoint at once. Selected data points appear as chips; remove one with its × or by pressing Backspace.

You can mix data points from several endpoints. OPC UA and S7 data are queried together and combined into one result set.

WARNING

At least one data point is required. A query with an empty WHERE field will not run — the page asks you to select a data point first.

GROUP BY — splitting into series

By default, every selected data point is aggregated together into a single series. Group By splits that single series into several:

• Monitor — one series per endpoint (grouped by monitor name).
• Data Point — one series per OPC UA node or S7 address.

You can combine both. For example, avg(value) grouped by Data Point produces one line per node, making it easy to compare tags against each other.

Time range and granularity

Open the clock icon in the panel header to set:

• Time Range — a quick range (last 15 minutes through last 30 days) or a custom start/end.
• Granularity — the size of each time bucket (10 seconds up to 1 week). Leave it on Auto to let Pulse pick a sensible bucket for the chosen range. When granularity is not set explicitly, Pulse buckets data by the hour.

Finer granularity gives more detail but more points; coarser granularity smooths the data and runs faster over long ranges.

Reading the results

After a query runs, the charts appear below the builder, with an Overview and a Table view in a tabbed control beneath them. A small summary line shows the query's execution time, the number of time buckets returned, and the granularity that was actually applied.

Charts

The charts are always shown. Each aggregation in your SELECT gets its own chart: a query with count and avg(value) produces two separate graphs — one per aggregation — so different units and scales never share a single axis. Within each chart, every Group By series is drawn as its own line.

The colors are explained by the Overview table below, where each row carries the same color as its line.

Incident markers

Incidents that occurred on the queried monitors during the time window are drawn on the charts as vertical markers, colored by status (unacknowledged, acknowledged, resolved). Use the Incidents button above the charts to show or hide individual incidents — handy for lining up a spike in the data with the incident it caused.

Overview

The Overview tab summarizes the whole window as a table with one row per group. Each aggregation is a column (e.g. count, avg(value)), and when you group by Monitor or Data Point those appear as columns too. A colored dot on each row matches that group's line in the charts.

These totals are computed over all readings in the window — so avg(value) is the true average across the window, percentiles are exact, and count is the total — not a combination of the per-bucket numbers.

Table

The Table tab shows the time-series breakdown — one row per time bucket and group, with a column for each aggregation. Columns are sortable. Use the table when you want the exact per-bucket numbers rather than a trend or a window total.

Suggested queries

Below the builder, Suggested Queries offers ready-made starting points for common questions, such as average value per data point, peak values, polling latency, the slowest endpoints, and latency distribution.

Selecting a suggestion fills in the SELECT, GROUP BY, granularity, and time range for you while keeping the data points you have already chosen. If you have not selected a data point yet, pick one in the WHERE field first, then run the suggestion.

The suggestions disappear once you run a query and return when you press Cancel.

Related documentation

• Monitors — the OPC UA nodes and S7 tags whose readings you query here.
• OPC UA and Siemens S7 — how the underlying data is collected.