Alerting

Alert on changed ratio between 2 different events?

andyk
Path Finder

I have events coming in that has a field called status_id. This field contains the values OK or ERROR. If I look at the last five minutes it's ok to have a ratio of 20% Errors and 80% events with status_id="OK".

How can I be alerted if the ratio changes to 50% Errors and 50% OK in next 5 minutes?

The total number of events during a 5 minutes period, can be between 20 and 200 depending on the time of the day.

Tags (1)
0 Karma
1 Solution

kristian_kolb
Ultra Champion

Try this;

sourcetype=your_sourcetype earliest=-5m | stats c AS Total c(eval(status_id="OK")) AS Good c(eval(status_id="ERROR")) AS Bad | eval bad_ratio = Bad/Total

Then set the search to run every 5 minutes, and alert on Custom Condition;

search bad_ratio > 0.25 

Hope this helps,

Kristian

View solution in original post

kristian_kolb
Ultra Champion

Try this;

sourcetype=your_sourcetype earliest=-5m | stats c AS Total c(eval(status_id="OK")) AS Good c(eval(status_id="ERROR")) AS Bad | eval bad_ratio = Bad/Total

Then set the search to run every 5 minutes, and alert on Custom Condition;

search bad_ratio > 0.25 

Hope this helps,

Kristian

View solution in original post

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!