Creating % Log Drop Alert?

OiskyPoisky — Mon, 13 Feb 2023 17:17:51 GMT

Hey There Folks,

Im looking at a way to measure a decrease in logging levels by host and eventcode. Ive setup the below query which is fine from a static perspective but very much looking to try and identify that scenario where lets say we see a 50% log drop off in a specific eventcode in the past 24 hour period.

index=wineventlog sourcetype=WinEventLog EventCode=4625 | fields EventCode, host | stats dc(host) as num_unique_hosts | where num_unique_hosts < 500

Is there an easy way to convert this over?

Thanks Kindly,

Tom

topic Creating % Log Drop Alert? in Alerting

Creating % Log Drop Alert?