How do I send an alert when the last 7 events of "fieldname" are increasing?

[marvinlee93]

I would like to send an alert when the last 7 events of "fieldname" are increasing.

And a table/timechart to display the time, indexes when it happens.

Anybody knows how to do this?

[whrg]

Perhaps streamstats can help you here.

I just played around with this search:

| makeresults count=20 | eval value=random()%100
| streamstats window=2 min(value) as minimum
| eval is_increase=if(value!=minimum,1,0)
| streamstats window=7 sum(is_increase) as increases

Now when searching for "increases>=7" should give you 7 subsequent increases.

[marvinlee93]

Hi, it's working. Thank you! Just to check this comment '| streamstats window=7 sum(is_increase) as increases
' means that the maximum count of INCREASES will only be 7? since the window size is 7?

[whrg]

True, the maxium count will only be 7. So it should be "search increases=7" instead of "search increases>=7".

I modified the search a little to make it somewhat easier:

| makeresults count=20 | streamstats count | eval value=random()%100
| streamstats current=false last(value) as previous
| eval diff=value-previous
| search diff!=0
| tail 7
| stats count(eval(diff>0)) as increases