Alerting

Alert based on sum(time)

aniketb
Path Finder

Hi,

I have a query for 1 hour as:

"Search String" sourcetype="XX" source="XX" | stats sum(time) by host

I have 2 hosts and i see

host1 28.7
host2 45.9

I need to set an alert if any of these host values reach 100. Any pointers?

Tags (3)
0 Karma
1 Solution

BobM
Builder

You can use where to filter the results

"Search String" sourcetype="XX" source="XX" | stats sum(time) as duration by host | where duration >= 100

Or if you wan to keep the smaller results you can set a custom condition in the alert settingss to be

where duration >= 100

View solution in original post

0 Karma

BobM
Builder

You can use where to filter the results

"Search String" sourcetype="XX" source="XX" | stats sum(time) as duration by host | where duration >= 100

Or if you wan to keep the smaller results you can set a custom condition in the alert settingss to be

where duration >= 100

View solution in original post

0 Karma

aniketb
Path Finder

Thanks BobM!

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!