My search ends with:
...
| stats count(Request) as RequestCnt, count(FailedRequest) FailedRequestCnt
| eval FaildRequestPercentage = RequestCnt / FailedRequestCnt * 100
How would I specify a trigger for FaildRequestPercentage > 10?
How would I include: RequestCnt, FailedRequestCnt , and FaildRequestPercentage values in my alert message?
Have the alert trigger when the number of results is not zero and let the query determine when the alert triggers.
...
| stats count(Request) as RequestCnt, count(FailedRequest) FailedRequestCnt
| eval FaildRequestPercentage = RequestCnt / RequestCnt * 100
| where FaildRequestPercentage > 10
| table RequestCnt RequestCnt FaildRequestPercentage