Need help on Alert Custom Trigger for a returned Search Percentage

mninansplunk — Mon, 16 Aug 2021 17:55:01 GMT

Hello,

I have the following Search that returns a percent_difference value.

sourcetype="orderdetail-prod"|stats count(PriceModelLevel) AS total, count(eval(PriceModelLevel="DEFAULT_SITEONE_LIST")) AS Default_Siteone_List|eval percent_difference=((Default_Siteone_List/total)*100) | table percent_difference

However, I can't figure out how to trigger an alert if the percentage_difference is >=20. I tried:

search percentage_difference >=20

Does this seem correct? If so, perhaps another setting in the Alert config is mucking it up as it never is triggered.

Thanks for any help you can give.

Re: Need help on Alert Custom Trigger for a returned Search Percentage

richgalloway — Mon, 16 Aug 2021 19:45:34 GMT

I find I get better results by doing all the filtering in my query and having the alert trigger if the number of results is not zero.

sourcetype="orderdetail-prod" | stats count(PriceModelLevel) AS total, count(eval(PriceModelLevel="DEFAULT_SITEONE_LIST")) AS Default_Siteone_List | eval percent_difference=((Default_Siteone_List/total)*100) | where percent_difference >= 20

topic Re: Need help on Alert Custom Trigger for a returned Search Percentage in Alerting

Need help on Alert Custom Trigger for a returned Search Percentage

Re: Need help on Alert Custom Trigger for a returned Search Percentage