Need quick help to find spike of counter from last hour to current hour if it's 20X then it should trigger.
Using mstats and mcatalog.
Thanks in advance.
Currently i have pasted sample query to get the view over logging structure.
| Mcatalog values (stack) as stack values(node) as node values(db) as db values(inst) as inst where index= main and [| mstats avg(_value) as value where index=main and counter=Subject or( counter= wells) metric_name=metrices by inst counter span=10m
|Streamstats global=f window=2 range(value) as value by inst counter
