alert when host sends less than 100 logs per hour

[sbattista09]

how to see when a set of host send under 100 logs per hour? stats count wont show a value of 0. and you cant use HEAD with fields(that i know of). Whats the best way to do this?

[adonio · Accepted solution]

you can use | tstats command, for the last 60 minutes every hour

 | tstats count where index = * by host | where count < 100

save as an alert and triger where count = 0

hope it helps

[sbattista09]

need to alert on hosts sending under 100 or so logs per hour.

[adonio]

when you say logs you mean events or source?

[sbattista09]

logs as in events.