search query is:
index="confiacd" | stats avg(responsetime)
Now I want to setup an alert when the avg(responsetime) > 500 , so where do i write this condition to setup alert.
Put the condition in the query:
index="confiacd" | stats avg(responsetime) as average_response | where average_response > 500
Then in your alert definition set your Trigger Condition to Number of Results > 0
What does your "500" threshold mean here?
Put the condition in the query:
index="confiacd" | stats avg(responsetime) as average_response | where average_response > 500
Then in your alert definition set your Trigger Condition to Number of Results > 0