topic Re: Threshold varies base on time in All Apps and Add-ons

Is it possible to define 2 threshold based on time?

cbiraris — Wed, 07 Jun 2023 07:12:00 GMT

Hi Team,

I am trying to schedule a alert base on threshold for 2 time window.

100 events between 00:00 to 14:00
20 events between 14:00 to 00:00

is it possible to define 2 threshold like above ? in one alert

index=ABC sourcetype=XYZ failedlogin |stats count |where count >100 between 00:00 to 14:00

index=ABC sourcetype=XYZ failedlogin |stats count |where count >20 between 14:00 to 00:00

Re: Threshold varies base on time

gcusello — Wed, 07 Jun 2023 07:11:09 GMT

Hi @cbiraris,

please try this.

index=ABC sourcetype=XYZ failedlogin | stats count earliest(_time) AS _time | eval time_hour=strftime(_time,"%H") | eval threeshold=if(time_hour<15,100,20) | where count>threeshold

Ciao.

Giuseppe

Re: Threshold varies base on time

cbiraris — Wed, 07 Jun 2023 07:22:27 GMT

Thank you @gcusello
Its working