Alert should be triggered when count is greater than 5 but also include records that don't trigger that alert
I want my alert to return 6 fields, but only in cases where six or more of them are where isToday = 1. This alert should also include cases where isToday = 0.
How can I do this?
Thanks!
Hi @paulalbert,
You can try below query
<yourquery>
| stats count(eval(if(diff1 < 3600*24*1, 1, null()))) as isToday by CWID, employeeStartDate, sn, givenName, employeeID, loginStatus
| eventstats sum(eval(if(isToday="1",1,0))) AS cn_isToday
| table CWID, empStartDate, sn, givenName, empID, loginStatus, isToday, cn_isToday
and then schedule alert with Alert Condition -> Trigger alert when -> Custom -> search cn_isToday >= 6
Hi @paulalbert,
You can try below query
<yourquery>
| stats count(eval(if(diff1 < 3600*24*1, 1, null()))) as isToday by CWID, employeeStartDate, sn, givenName, employeeID, loginStatus
| eventstats sum(eval(if(isToday="1",1,0))) AS cn_isToday
| table CWID, empStartDate, sn, givenName, empID, loginStatus, isToday, cn_isToday
and then schedule alert with Alert Condition -> Trigger alert when -> Custom -> search cn_isToday >= 6
Thank you so much!!