Hi all,
I need to create an alert that will be triggered when a latency threshold is breached for sustained 30 minutes.
I am doing my research on how to incorporate streamstats into my query, and so far I have come up with this:
index="x" source="y" EndtoEnd
| rex (?<e2e_p>\d+)ms \\Extracts the numerical value from the e2e_p field.
| where isnotnull(e2e_p)
| streamstats avg(e2e_p) window=1800 current=t time_window=30m as avg_e2e_p
| where avg_e2e_p > 500
The condition doesn't happen often, but I'll work with the team that supports the app to simulate the condition once the query is finalized.
I have never used streamstats before, but that's what has come up in my search for a means to incoporate a sliding window into a SPL query.
Thank you in advance for taking the time to help with this.
