topic Help with query to notify when date is older than x amount of days in Alerting

Help with query to notify when date is older than x amount of days

goken — Fri, 11 Feb 2022 16:55:49 GMT

Hi all,

I have a table called active_services.csv.
One of the fields is called Report_Date

Date value is in the following format 20220124.
The CSV file is automatically updated weekly but sometimes fails and requires manual intervention.

I need help with a query so I can setup an alert to notify me when the report date value is older than X amount of days.

Please help.

Thank you for your help in advance.

gcusello — Fri, 11 Feb 2022 07:47:29 GMT

I suppose that you are ingesting the active_services.csv in an index.

So you could run a search like this (where X=30 days):

index=your_index | eval Diff=strptime(Report_Date,"%Y%m%d")-86400*30 | where Diff>0

In this way, if you have results there are events outdated and you can create an alert with this search.

Ciao.

Giuseppe

ITWhisperer — Fri, 11 Feb 2022 07:51:42 GMT

| eval days=floor((relative_time(now(),"@d")-strptime(report_date,"%Y%m%d"))/(60*60*24))