Creating an alert that mointors specific entries of an index compared to entire index

[pdreef]

index=dart_index source=DMZ_IncomingOutgoing status_message="OK" earliest=-48h@h
| eval DeliveryComplete=strptime(delivery_complete, "%Y-%m-%d %H:%M:%S")
| stats values(src_host) as Source, values(dest_host) as Destination, values(login_name) as DataOwner, values(host_name) as DartNode, values(xfer_type) as XferMethod, min(DeliveryComplete) as EarliestFileXfer, max(DeliveryComplete) as LastFileXfer by subscription_name
| where now()>relative_time(LastFileXfer, "+24h@h")
| eval DaysOld=round((now() - round(LastFileXfer, 0))/86400, 2)
| eval EarliestFileXfer=strftime(EarliestFileXfer, "%Y-%m-%d %H:%M:%S")
| eval LastFileXfer=strftime(LastFileXfer, "%Y-%m-%d %H:%M:%S")
| table subscription_name Source Destination DataOwner DartNode XferMethod EarliestFileXfer LastFileXfer DaysOld

I have search that was created by a previous developer and it searches the entire index labeled " subscription_name" The problem is we only want to monitor a certain number of subscrption compared to the entire table of subscription in our DB.

[pdreef]

Thanks for the help and assistance. 

The solution is as follows,

Subscription_name OUT (" sub_A | sub_B")

[scelikok · Accepted solution]

Hi @pdreef, I believe you want to filter some subscription names. If so, please try below;

index=dart_index source=DMZ_IncomingOutgoing status_message="OK"  subscription_name IN ("subs_A","subs_B","subs_C") earliest=-48h@h
| eval DeliveryComplete=strptime(delivery_complete, "%Y-%m-%d %H:%M:%S")
| stats values(src_host) as Source, values(dest_host) as Destination, values(login_name) as DataOwner, values(host_name) as DartNode, values(xfer_type) as XferMethod, min(DeliveryComplete) as EarliestFileXfer, max(DeliveryComplete) as LastFileXfer by subscription_name
| where now()>relative_time(LastFileXfer, "+24h@h")
| eval DaysOld=round((now() - round(LastFileXfer, 0))/86400, 2)
| eval EarliestFileXfer=strftime(EarliestFileXfer, "%Y-%m-%d %H:%M:%S")
| eval LastFileXfer=strftime(LastFileXfer, "%Y-%m-%d %H:%M:%S")
| table subscription_name Source Destination DataOwner DartNode XferMethod EarliestFileXfer LastFileXfer DaysOld

 You can put your subscription_names to be monitored inside IN () block.

If this reply helps you an upvote is appreciated. 

[pdreef]

Yes, this worked.! I imagine you can use an OUT for entries you do not want to see in your alert. I will play around and see if that is possible. Thank you for taking the time to help me and my team. 

[scelikok]

@pdreef, great to know it works. 

There is no OUT function, you can use NOT IN () to filter the entries you do not want to see in your alert.

Best Regards

[pdreef]

The NOT IN () did not work in the search, was given the error code below.

Error in 'search' command: Unable to parse the search: Comparator 'IN' has an invalid term on the left hand side: NOT.