Alert based on meeting criteria over a certain time period

[tblue]

I'm trying to convert this Search into an alert

index=cj t=* earliest=-60m  | eval myfield=case(t >= .051, "Over", t <= .050, "Under") | timechart count by myfield |  eval Total=Over+Under |eval OverPerc=100*Over/Total | eval UnderPerc=100*Under/Total  | fields Total Under UnderPerc Over OverPerc

i've tried searchtimespanminutes but the output still shows in like 5 second increments.

I want to add ... |where OverPerc>= .1

But want it to be over say a 10 minute period, I want OverPerc to not exceed .1 over a given timeframe, even in real time, it should not alert if it's only matched one result, it should wait until it loads the 60 minutes or 10 minutes, or 5 minutes of data to make the match.

Thanks

[martin_mueller]

To force your timechart into grouping larger spans of time together, change it like this:

... | timechart span=10m count by myfield | ...

In case you're getting false positives due to the clock being for example 02:00:05 and only one event occurred during those five seconds, you can add this:

... | timechart span=10m partial=f count by myfield | ...

That way buckets are discarded if the ten minute span isn't over yet.

[tblue]

BAHH, always trying to make it harder then it is.. Thanks this worked!