I am trying to do a nested alarm journal query in a report. The search filter is anything with ‘T5’ in it, which is the line name. I am only looking for active events. For some reason, even though the fault pictured below shows active in the report for 29 minutes, it actually was only active for less than a minute (see the database attachment). It looks like it is never reading in the cleared event. Is this normal behavior and I am just missing something? Thanks.
I had the display path for all the tags set to the same. I’m going to try to remove the binding on this and see if the problem is resolved.
The Alarm Query in reporting doesn’t work quite like the Alarm Journal, which may be causing some confusion for you. (FWIW, we have a ticket to add an option for it to work either way.)
The Alarm Query in reporting works like system.alarm.queryJournal, where an alarm becoming active is a separate event from an alarm clearing, and return different rows. This means your active time won’t be what you expect.
 Looks like we added that toggle in 7.8.2.
I resolved this using scripting. First ordering the query by eventid. If the previous state was active and the current state clear, subtracting the dates to get the time.
Thanks for the help!