Hi,
I want to create alert when for 5 consecutive minutes the threshold breaches 70% ?
The query I wrote is:
sourcetype="os" identity_operation="GetUser" minutesago= 1
| eval EndpointName = "Get User" | stats count by EndpointName
| eval message = case(count >= 1 * 1200,"100% alert",
count >= 0.9 * 1200,"90% alert",
count >= 0.8 * 1200,"80% warning",
count >= 0.7 * 1200,"70% warning")
Hi @amitrinx,
you have to insert an activation threshold, something like this:
sourcetype="os" identity_operation="GetUser" minutesago= 1
| rename "Get User" AS EndpointName
| stats count by EndpointName
| where count>= 0.7 * 1200
| eval message = case(count>=1*1200,"100% alert",
count>=0.9*1200,"90% alert",
count>=0.8*1200,"80% warning",
count>=0.7*1200,"70% warning")
otherwise, your alert is always triggered also for values less than your threshold.
Ciao.
Giuseppe