Real-Time Analytics: From Raw Data Stream to Real-Time Operational Insight

Industrial sensors generate thousands of readings every second. The real challenge is not the volume — it is the gap between data arriving and insight being acted on. By the time data is queried, anomalies are spotted, and decisions are made, the best window for intervention has already passed. A compressor’s efficiency has been quietly declining for weeks. A subtle vibration drift appeared months ago. OEE dips below target on the same shift, every week. The signals are all there in the data — they just have no one watching them in real time.

TDengine’s real-time analytics keeps computation running continuously on the data stream. Engineers configure analysis rules and the system executes them without interruption — generating KPIs, detecting anomalies, triggering alerts. Known thresholds and conditions can be defined precisely with rules. Complex deviations that are hard to describe in advance are handled automatically by the TDgpt AI engine. Both approaches run side by side on the same platform, covering the known and the unknown.

Computation Runs Inside the Database, Not the Application Layer

TDengine includes a high-performance stream processing engine built into the database core. Each analysis maps to a TDengine stream — created and managed through SQL, executing continuously as data is written. No application server resources are consumed. If the application layer restarts or a network interruption occurs, streams continue running at the database level.

When sensor data arrives late or out of order, TDengine recomputes the affected time windows to keep results accurate. For scenarios requiring historical coverage, streams can backfill past data on creation — so the moment an analysis goes live, its historical trend line is already complete. Results are written back into TDengine as time-series values, stored alongside raw sensor data, queryable via SQL, displayable on dashboards, or usable as input to downstream analyses.

Engineers can create and manage streams directly in SQL. For those who prefer not to write code, TDengine IDMP provides a graphical configuration interface that generates the same underlying SQL streams — no syntax required.

Configure the trigger inside TDengine analysis

Eight Trigger Types to Match Every Industrial Data Pattern

Not all industrial data arrives on a fixed schedule. Some devices push readings every second; others only produce records when a state changes. Some processes run on clock time; others are organized around batch IDs. Some anomalies are instantaneous; others only make sense as a complete sequence of events observed over time.

TDengine provides eight stream trigger types, each suited to a different data pattern. For rolling KPIs that need continuous refresh, a sliding time window keeps the calculation moving with the data. When a machine transitions between running, idle, and fault states, a state window triggers automatically at each transition and summarizes what happened during that state. When a batch device goes silent after completing a run, a session window detects the gap and fires a batch summary. When you need to capture the full arc of a temperature exceedance — from onset to recovery — an event window lets you define start and end conditions as expressions and computes peak, average, and duration across the entire episode. Every trigger type has a corresponding option in the IDMP configuration interface: select the type, fill in the parameters, and the underlying SQL stream is generated automatically.

TDgpt: Anomaly Detection Without Predefined Rules

Threshold-based alerting works well for known failure modes: alert when temperature exceeds 85°C, alert when vibration exceeds 12 mm/s. It handles what you already know to look for. But the early signals of gradual degradation rarely cross any hard limit.

TDengine includes TDgpt, a built-in time-series AI engine that exposes anomaly detection through the ANOMALY_WINDOW() SQL function. Rather than evaluating data against fixed thresholds, TDgpt learns the normal behavior pattern of a target attribute and continuously flags deviations from that pattern — even when values remain within nominal ranges. A chiller’s coefficient of performance drifting outside its historical envelope triggers an event. A subtle periodic fluctuation in pump flow rate — the early signature of impeller cavitation — gets flagged before bearing failure occurs.

TDgpt supports a range of algorithms, from parameter-free classical methods such as IQR and Isolation Forest, to sequence-aware deep learning models such as LSTM-AD that capture periodic and trend-based behavior, to TDtsfm — TDengine’s pretrained time-series foundation model that works zero-shot when historical data is limited. Engineers can invoke ANOMALY_WINDOW() directly in SQL, or configure anomaly detection as a trigger type in IDMP’s analysis interface by selecting the target attribute and algorithm and saving.

The analysis tasks are suggested based on the data collected by LLM

AI-Assisted Configuration: From Description to Running Analysis

Configuring stream analytics correctly requires understanding trigger mechanics, selecting the right aggregation function, and mapping outputs to the right attributes. IDMP’s built-in AI assistant reduces this to a description. Type what you need — “calculate the 15-minute rolling average power factor, sliding every 5 minutes” — and the AI generates a complete analysis configuration: trigger type, interval, aggregation window, output expression, and target attribute, all prefilled and ready to review before saving.

The AI also pushes recommendations proactively. Based on the element’s template, attribute definitions, and collected data, it suggests analyses suited to that specific device. For an electricity meter, it might recommend hourly peak voltage or power factor monitoring. For a compressor, discharge temperature anomaly detection. Whether an engineer starts from a description or picks from the recommendation list, the result is the same: a standard TDengine stream running continuously at the database layer.

Frequently Asked Questions

  1. What is the difference between real-time analytics and dashboard alerts?

    Dashboard alerts are typically evaluated by the frontend when a user is viewing a page, or triggered by periodic polling. TDengine’s real-time analytics is stream processing running continuously inside the database core — independent of whether any page is open or any user is online. Results are written back into TDengine, and all downstream alerts, events, and KPI displays are built on values that have already been computed.

  2. Do engineers have to use the IDMP interface, or can they write SQL directly?

    Both are fully supported. TDengine streams are created and managed through SQL, so engineers who prefer to work at that level can do so directly. IDMP’s graphical interface and AI assistant sit on top of the same SQL stream layer — the configuration they generate produces identical streams. The two approaches are interchangeable.

  3. Does real-time analytics support cross-device aggregation?

    Yes. TDengine’s supertable design reduces aggregation across devices of the same type to a single supertable query — no JOINs required. In IDMP, selecting child-element aggregation mode runs the computation across all child devices sharing a template, such as averaging active power across all turbines in a wind farm or summing energy consumption across all machines on a production line. Filters can narrow the scope further — for example, aggregating only devices currently in a running state.

  4. Can historical data be backfilled when a new analysis is created?

    Yes. Enabling history backfill at creation time and specifying a start date causes TDengine to apply the same stream processing logic to historical data and write results into the corresponding attribute. The historical trend line is complete as soon as the analysis goes live.

  5. Can TDgpt anomaly detection and threshold-based alerting run together on the same device?

    Yes, and they are complementary. Threshold alerts handle known, well-defined boundary conditions precisely. TDgpt anomaly detection identifies deviation patterns that cannot be specified in advance. Multiple analyses can run simultaneously on the same device, each monitoring a different dimension of behavior and triggering its own events and alerts independently.