dears,
this is my basic search:
index=index1 source=source1 sessionID
I will like compare the results (count) of the basic search for some timestamps and generate an alert mail if .
for exemple:
index=index1 source=source1 sessionID earliest = -10m latest = now --> Result1
index=index1 source=source1 sessionID earliest = -5m latest = now --> Result2
If Result2< 0,75*Result1 --> generate mail containing Result1
thanks
Try something like this
index=index1 source=source1 sessionID earliest = -10m latest = now | eval Result2=if(_time>relative_time(now(),"-5m"),1,0) | eventstats count as Result1 sum(Result2) as Result2 | where Result2< 0.75*Result1