Hi ,
I have a query which returns 5 events ( basically 5 files gets transferred) . I need to send an alert once all 5 files are transferred - meaning as soon as the event count is 5 , alert should be triggered. IS the below query good enough for such scneario ?
Should I write like index=* X y | stats count by FileName | where count=5
Does only success populate the event?
yes , if only success / transfer happen - event gets written
well, your query is enough for this, I think.
So while setting up Alert - should I mention Trigger Alert when Number of Results is greater than 4. OR will the query takes care of it.
I am little confused .
you use | where count=5
, so to fire
alert
event count > 0
Thank you
please provide your query for answer and accept it.
up voted your answer
thank you rashi83