Alerting

Conditional alerting examples?

Champion

I'm trying to set up a conditional alert where if there are less than 50 results but greater than 0 results, I want to be alerted. It seems straightforward but I can't figure out the syntax of the condition to use. The following does not work, for example:

mysearch | stats count dc(memberUid)

condition: 0 < dc(memberUid) < 50

1 Solution

Motivator

Try renaming your distinct count field.

mysearch | stats count dc(memberUid) as dc_uid

condition: 0 < dc_uid < 50

View solution in original post

Motivator

Try renaming your distinct count field.

mysearch | stats count dc(memberUid) as dc_uid

condition: 0 < dc_uid < 50

View solution in original post

Champion

That worked. Thanks 🙂

0 Karma