Search1: What this does is eval checkout logs from 5 minutes ago to 2 minutes ago,then eval for Peak/OffPeak Tim of Day, and add a Trigger/Don't Trigger condition.
THEN
Search 2: The search is run again to eval checkout logs from 2 minutes ago to now,eval for Peak/OffPeak Tim of Day, and add a Trigger/Don't Trigger condition.
Then I combine them using appendcols and the alert is set where Check1=Trigger AND Check2=Trigger send alert.
What I am trying to do is run this search and eval each minute to compare to the next minute. If any time in the 5 minute span, a Trigger happens twice in a row, then send an alert.
But in testing, I found that this won't work as if minute 5 (oldest) and minute 4 (second oldest) both = Trigger, since they are both under Check1, then it will not trigger.
Maybe this is not the best way to do this...any thoughts?
index=java host=byx api_domain=purchase api_method=checkoutShoppingCart status=SUCCESS subscriber=xxx@gmail.com "app_name=Gen31Application"
earliest=-5min@min latest=-2min@min
| eval HourOfDay=strftime(_time, "%H%M") | eval PeakOrOffPeak=if(((HourOfDay>=900) AND (HourOfDay<=1700)), "Peak", "OffPeak") | bucket _time span=1min | stats count by _time, PeakOrOffPeak
| eval Check1=if(PeakOrOffPeak = "OffPeak" AND count < 1, "Trigger", "Dont Trigger")
| appendcols [search
index=java host=byx api_domain=purchase api_method=checkoutShoppingCart status=SUCCESS subscriber=xxx@gmail.com "app_name=Gen31Application"
earliest=-2min@min latest=now
| eval HourOfDay=strftime(_time, "%H%M") | eval PeakOrOffPeak=if(((HourOfDay>=900) AND (HourOfDay<=1700)), "Peak", "OffPeak") | bucket _time span=1min | stats count by _time, PeakOrOffPeak
| eval Check2=if(PeakOrOffPeak = "OffPeak" AND count < 1, "Trigger", "Dont Trigger")]
Thanks!
Give this a try
Updated
index=java host=byx api_domain=purchase api_method=checkoutShoppingCart status=SUCCESS subscriber=xxx@gmail.com "app_name=Gen31Application" earliest=-5min@min latest=now | bucket _time span=1min | eval HourOfDay=strftime(_time, "%H") | eval PeakOrOffPeak=if(((HourOfDay>=9) AND (HourOfDay<17)), "Peak", "OffPeak") | stats count by _time, PeakOrOffPeak | eval Check=if(PeakOrOffPeak = "OffPeak" AND count < 1, "Trigger", "Dont Trigger") | streamstats current=f window=1 values(Check) as prev | where prev=Check AND Check="Trigger")
Give this a try
Updated
index=java host=byx api_domain=purchase api_method=checkoutShoppingCart status=SUCCESS subscriber=xxx@gmail.com "app_name=Gen31Application" earliest=-5min@min latest=now | bucket _time span=1min | eval HourOfDay=strftime(_time, "%H") | eval PeakOrOffPeak=if(((HourOfDay>=9) AND (HourOfDay<17)), "Peak", "OffPeak") | stats count by _time, PeakOrOffPeak | eval Check=if(PeakOrOffPeak = "OffPeak" AND count < 1, "Trigger", "Dont Trigger") | streamstats current=f window=1 values(Check) as prev | where prev=Check AND Check="Trigger")
In testing I got this back:
Error in 'streamstats' command: The argument 'value(Check)' is invalid.
Simple mistake:
index=java host=*byx* api_domain=purchase api_method=checkoutShoppingCart status=SUCCESS subscriber=xxx@gmail.com "app_name=Gen31Application" earliest=-5min@min latest=now | bucket _time span=1min | eval HourOfDay=strftime(_time, "%H") | eval PeakOrOffPeak=if(((HourOfDay>=9) AND (HourOfDay<17)), "Peak", "OffPeak") | stats count by _time, PeakOrOffPeak | eval Check=if(PeakOrOffPeak = "OffPeak" AND count < 1, "Trigger", "Dont Trigger")| streamstats current=f window=1 values(Check) as prev | where prev=Check AND Check="Trigger"
changed "value" to "values" and removed closing ")"
Good to go
Haha added the reponse at the same time!
Grrrrrrrrr typo. use 'values' instead of 'value'. Updated the answer.