Alert on Count and print a table

[varunghai]

Hi,

I want to create an alert where, I want to raise an alert if the count of total number of errors is greater than 10, then i want to print a table with error count on each host.

Query -
index=weblogs host="nlhypsewb*.*" sourcetype=web "The timeout specified has expired" earliest=-15m
| stats count(host) as COUNT
| where COUNT > 4

This query gives me correct results but it only gives me a column with total count
But when this query is giving some results then i want to generate an email which shows the count of errors on each host. How do I add those details in this query without using a Case if possible? I want to know if there is another option apart from using a switch Case.

[mayurr98 · Accepted solution]

hey you can try something like this
If you want to see error count on each host then you should write

index=weblogs host="nlhypsewb*.*" sourcetype=web "The timeout specified has expired" earliest=-15m 
| stats count(host) as COUNT by host 
| eventstats sum(COUNT) as total_count | where total_count>10 | fields - total_count

let me know if this helps!

[varunghai]

Hi Mayur, thanks for your answer, but using this query the fnal output table will be based on count per host so if for eg- host1 has count 11 and host2 has count 2 it will show only the host with count 11, which may lead to misinterpretation of the alert as the alert condition is when total number of errors overall on all the hosts is greater than 10.

[mayurr98]

Hey yeah i got it. I have changed my query pls check and let me know.. i have set the threshold on the total number of count !