topic timechart, timewrap output alert in Alerting

timechart, timewrap output alert

cbiraris — Mon, 18 Dec 2023 07:43:50 GMT

Hi Team,

I am looking for the help to get an alert trigger if the latest result of timechart command is 0.

Suppose i am running a search for last 8hrs with span=2hrs. so, if the result is something like below should raise an alert.

12-18-23 00:00 ---> is "0"

and also it should is display if there is "0" events in last 8hrs. as i am getting nothing, if no events during that time.

Thank you,

Re: timechart, timewrap output alert

gcusello — Mon, 18 Dec 2023 08:32:56 GMT

Hi @cbiraris,

you could simplify your alert running it every two hours using a simple search:

index=your_index earliest=-2h@h latest=@h

that fires if you haven't results.

Ciao.

Giuseppe

Re: timechart, timewrap output alert

cbiraris — Mon, 18 Dec 2023 08:36:53 GMT

@gcusello Thank you for response

I also want result of previous 8hrs with 2hrs interval to be displayed in alert result.

Re: timechart, timewrap output alert

gcusello — Mon, 18 Dec 2023 09:31:54 GMT

Hi @cbiraris,

adapt this sample to you use case:

it shuld be something similar to this:

<your_search> | timechart count span=1h | eval col=strftime(_time,"%Y-%m-%d %H:%M:%S")." - ".count | stats values(col) AS col latest(count) AS latest | where latest=0

Ciao.

Giuseppe