Generate a alert when the status field change from 500 to 200

[raghunandan]

Generate a alert when the http status field change from 500 to 200. There are some responsecode 502,so success rate responsecode 200 very high .So we want the first success responsecode 200 ,after 500

[ITWhisperer]

Start with a search to find the boundary - you may need to sort or reverse to get the events in the right order

| streamstats window=1 current=f values(responseCode) as previousResponseCode
| where responseCode=200 AND previousResponseCode!=200 AND isnotnull(previousResponseCode)