topic How to define 2 thresholds based on time? in Other Usage

How to define 2 thresholds based on time?

cbiraris — Tue, 05 Sep 2023 19:41:27 GMT

Hi Team,

I am trying to schedule a alert base on threshold for 2 time window.

If fall to 0 events between 23:00 to 07:00
If fall to less then 20 events between 07:00 to 23:00

is it possible to define 2 threshold like above ? in one alert

index=ABC sourcetype=XYZ login |stats count |where count =0 between23:00 to 07:00

index=ABC sourcetype=XYZ login |stats count |where count <=20 between 07:00 to 23:00

Please advise.

Thank you

Re: To define 2 threshold based on time?

gcusello — Tue, 05 Sep 2023 09:07:08 GMT

Hi @cbiraris,

yes, you have to define a threshold value using eval:

index=ABC sourcetype=XYZ login | stats count | eval time_hour=strftime(now(),"%H") | eval threshold=if(time_hour>22 OR time_hour<8,0,20) | where count<=threshold

Ciao.

Giuseppe

Re: To define 2 threshold based on time?

ITWhisperer — Tue, 05 Sep 2023 09:09:15 GMT

index=ABC sourcetype=XYZ login |stats count |where count=0 OR (count <=20 AND tonumber(strftime(now(),"%H")) >= 7 AND tonumber(strftime(now(),"%H")) < 23)

Re: To define 2 threshold based on time?

cbiraris — Tue, 05 Sep 2023 09:16:05 GMT

Thank you @gcusello,
Its Working

Re: To define 2 threshold based on time?

cbiraris — Tue, 05 Sep 2023 09:26:14 GMT

Also, can we define 2 different search run interval in this query ? like below---

index=ABC sourcetype=XYZ login |stats count |where count =0 between23:00 to 07:00, search can be run every after 2 hours to check last 2 hours events

AND

index=ABC sourcetype=XYZ login |stats count |where count <=20 between 07:00 to 23:00, , search can be run every after 1 hours to check last 1 hours events

Re: To define 2 threshold based on time?

ITWhisperer — Tue, 05 Sep 2023 10:34:23 GMT

You can do this in one alert but it gets a bit messy - you would probably be better off using two alerts with different schedules, time periods and alert criteria