Alert trigger question

Bliide — Tue, 02 Sep 2014 13:50:46 GMT

I have an alert that is triggering when conditions are not met. The search for the alert is:

index=foo earliest=-1d@d latest=@d setMeterSpot SystemName!=foo1 SystemName!=foo2 | eval SystemName=upper(SystemName)| timechart span=1d count(SessionId) by SystemName usenull=f | sort -_time | rename _time as "Date Logged" | convert timeformat="%Y-%m-%d" ctime("Date Logged")

This search returns a table with 7 columns. Date Logged, and 6 columns with system names. The first column returns the date for the day of the search and the other 6 columns return a number value. Standard number for a daily search on this is 288. I was trying to setup an alert that triggered when the number was below 260 in any of the 6 columns. I tried using the same search and setting a condition to trigger if number of results is less than 260. I thought it was working but I have had the alert trigger when there is not a column that is below 260.

Do I need a where condition in there?

Is the trigger condition adding every column to get the number to trigger off of?

Please advise.

Re: Alert trigger question

aholzer — Tue, 02 Sep 2014 14:15:38 GMT

I'd suggest you change your search to only return rows you want to alert on (include the where / search clause in your search string to limit your results). Then simply use the alert condition: when search results > 0.

Hope this helps

topic Alert trigger question in Alerting

Alert trigger question

Re: Alert trigger question