topic Re: Search Query - Alert in Alerting

Search Query - Alert

rashi83 — Tue, 09 Jun 2020 21:04:26 GMT

Hi ,
I have a query which returns 5 events ( basically 5 files gets transferred) . I need to send an alert once all 5 files are transferred - meaning as soon as the event count is 5 , alert should be triggered. IS the below query good enough for such scneario ?

Should I write like index=* X y | stats count by FileName | where count=5

Re: Search Query - Alert

to4kawa — Tue, 12 May 2020 20:36:24 GMT

Does only success populate the event?

Re: Search Query - Alert

rashi83 — Tue, 12 May 2020 20:38:24 GMT

yes , if only success / transfer happen - event gets written

Re: Search Query - Alert

to4kawa — Tue, 12 May 2020 20:49:33 GMT

well, your query is enough for this, I think.

Re: Search Query - Alert

rashi83 — Tue, 12 May 2020 20:55:41 GMT

So while setting up Alert - should I mention Trigger Alert when Number of Results is greater than 4. OR will the query takes care of it.

I am little confused .

Re: Search Query - Alert

to4kawa — Tue, 12 May 2020 20:59:25 GMT

you use | where count=5
, so to fire
alert

event count > 0

Re: Search Query - Alert

rashi83 — Tue, 12 May 2020 21:01:58 GMT

Thank you

Re: Search Query - Alert

to4kawa — Tue, 12 May 2020 21:05:36 GMT

please provide your query for answer and accept it.

Re: Search Query - Alert

rashi83 — Tue, 12 May 2020 21:12:54 GMT

up voted your answer

Re: Search Query - Alert

to4kawa — Tue, 12 May 2020 21:19:46 GMT

thank you rashi83