Conditional alerting examples?

[the_wolverine]

I'm trying to set up a conditional alert where if there are less than 50 results but greater than 0 results, I want to be alerted. It seems straightforward but I can't figure out the syntax of the condition to use. The following does not work, for example:

mysearch | stats count dc(memberUid)

condition: 0 < dc(memberUid) < 50

[ftk · Accepted solution]

Try renaming your distinct count field.

mysearch | stats count dc(memberUid) as dc_uid

condition: 0 < dc_uid < 50

[the_wolverine]

That worked. Thanks 🙂