Alert when sum of values is greater than 25% of sum of other values

[kelseycasco]

I would like to make an alert that is triggered when the sum of some values is greater than 25% of the sum of another set of values. Basically, I would like to alert the user when the quantity of scrap produced is greater than 25% of however much quantity is produced. Right now I have the following in a search:

index=wipscrap OR index=componentscrap
| stats sum(Scrap) AS totalscrap sum("Qty Good") AS totalqty
| eval scrapallowed=totalqty*.25

This gives me a table with three columns and the sum of the values for each column. Do I need more information in my search for this alert to work? What would my custom trigger be to make this work?

[gcusello]

Hi kelseycasco,
you could add at the end of your search

| where totalscrap>scrapallowed

in this way, if you have results alert is triggered otherwise it's ok.
So you can set an alert when results are greather than zero.

Bye.
Giuseppe

[Sukisen1981]

just add a where condition
index=wipscrap OR index=componentscrap
| stats sum(Scrap) AS totalscrap sum("Qty Good") AS totalqty
| eval scrapallowed=totalqty*.25 |where totalscrap >scrapallowed
Trigger alert if results are more than 0 should do it