topic Re: How to create a single alert to trigger only when a threshold is passed by a single index, not all indexes combined? in Alerting

How to create a single alert to trigger only when a threshold is passed by a single index, not all indexes combined?

khagan — Fri, 18 Sep 2015 14:57:02 GMT

Hi everyone,

I'm trying to write an alert, covering all indexes, that triggers when a specific number (say, 50) of events occur. However, I only want the alert to trigger if all 50 events are in the same index, not, for example, 40 in one index and 10 in another. Is there a way to specify this in the search string, or would I need to have a different alert for each index?

Re: How to create a single alert to trigger only when a threshold is passed by a single index, not all indexes combined?

somesoni2 — Fri, 18 Sep 2015 18:19:33 GMT

Will something like this would work

| tstats count WHERE index=* by index | where count>50

Re: How to create a single alert to trigger only when a threshold is passed by a single index, not all indexes combined?

Federica_92 — Thu, 24 Sep 2015 10:09:58 GMT

the problem is that this query return only the number of every index, if it's higher than 50, I need something like:

  sourcetype=windows  EventId=X status=Y earliest=-5m | stats count by EventID | where count>5 | search tstats count WHERE index=* by index|  where count>0

Basically I need to execute the first part of the query, for all the indexes, but I need to display separate results for each of the indexes.
Is it possible?

Re: How to create a single alert to trigger only when a threshold is passed by a single index, not all indexes combined?

sover — Thu, 24 Sep 2015 21:56:39 GMT

Hi khagan, you can do:

<your search> | stats count by index

And then through the gui (or savedsearches), you can make a custom alert to only trigger when one of the counts is > 50, but still display all of the counts.