topic alert when host sends less than 100 logs per hour in Alerting

alert when host sends less than 100 logs per hour

sbattista09 — Fri, 19 May 2017 16:08:40 GMT

how to see when a set of host send under 100 logs per hour? stats count wont show a value of 0. and you cant use HEAD with fields(that i know of). Whats the best way to do this?

Re: alert when host sends less than 100 logs per hour

sbattista09 — Fri, 19 May 2017 16:09:37 GMT

need to alert on hosts sending under 100 or so logs per hour.

Re: alert when host sends less than 100 logs per hour

adonio — Fri, 19 May 2017 16:18:19 GMT

when you say logs you mean events or source?

Re: alert when host sends less than 100 logs per hour

sbattista09 — Fri, 19 May 2017 16:22:21 GMT

logs as in events.

Re: alert when host sends less than 100 logs per hour

adonio — Fri, 19 May 2017 17:19:55 GMT

you can use | tstats command, for the last 60 minutes every hour

 | tstats count where index = * by host | where count < 100

save as an alert and triger where count = 0

hope it helps