How to check if the events count is greater than threshold in a specific timeframe?

[Nidd]

Requirement:

I have a ton of events and I need to create an alert that keeps monitoring my job for the number of events it processed for the last 1 hour. It should alert whenever the events count exceeds a specific threshold.

I have the below query framed. But it is not showing results at all, even when there are results to be shown.

index=myIndex "myJob" earliest=-1h latest=now |  stats count  as eventsCount by _time | where eventsCount > 5000

Where am I making a mistake? Please help.

[The_Data_Pirate]

Hey Nidd,

I have had a little play, please try the below search and see if it works for your use case. I've put the count in buckets of 5m chunks with the span argument. Feel free to change this to what ever works for you.

| timechart count span=5m 
| eval outlier=if(count>5000,1,0) 
| search outlier=1