How do I create an alert that will search for two separate string values with the OR condition inside the search?

Curiuu — Wed, 25 Jan 2023 23:58:32 GMT

I'm creating an alert that will search for two separate string values with the OR condition inside the search. Is there a way to setup the alert condition to fire for 'If the second event is not found within 5 minutes of the first event, fire the alert.'? The events happen anytime within a 6 hour window, so having it search every 5 minutes for a count under 2 would fire alerts constantly.

Re: Custom Alert

ITWhisperer — Wed, 25 Jan 2023 15:40:58 GMT

Try this running over the previous 10 minutes (or longer).

<search string1 or string2> ``` Ensure events in chronological order ``` | sort 0 _time ``` Get timeframe of search ``` | addinfo ``` Capture time of event if string 1 present (however you determine that) ``` | eval string1_time=if(<string1 in event>, _time, null()) ``` Capture time of event if string 2 present (however you determine that) and after the first 5 minutes ``` | eval string2_time=if(<string2 in event> AND _time >= info_min_time + 300, _time, null()) ``` Track latest times of string 1 through the event stream ``` | streamstats max(string1_time) as last_string1_time ``` Mark string 2 events as not OK if no previous string 1 or if previous string 1 too far in the past ``` | eval NOK=if(isnotnull(string2_time), if(isnotnull(last_string1_time) AND string2_time - last_string1_time <= 300, 0, 1), null()) ``` Remove timing for string 1 events if in last 5 minutes ``` | eval string1_time=if(isnotnull(string1_time) AND string1_time <= info_max_time - 300, string1_time, null()) ``` Count bad string 2 events and get last string 1 time prior to last 5 minutes ``` | stats sum(NOK) as NOK max(string1_time) as last_string1_time ``` Alert condition (number of results > 0) if any bad string 2 events or no string 2 events but there were string 1 events prior to last 5 minutes ``` | where NOK > 0 OR (isnull(NOK) AND isnotnull(last_string1_time))

Re: Custom Alert

Curiuu — Fri, 27 Jan 2023 16:49:19 GMT

Got this to work, thank you so much!

topic How do I create an alert that will search for two separate string values with the OR condition inside the search? in Alerting

How do I create an alert that will search for two separate string values with the OR condition inside the search?

Re: Custom Alert

Re: Custom Alert