Scenario:
Example query : index=XXXX name=somefile | stats count(msg) as MESSAGE
The above query will always return some count.
I want to alert if the Message=0 for two consecutive 5 min interval over the last 15 min interval i.e. when no values are returned.
earliest=-15m if two out of three interval (5min) the message=0 i want to take some actions
Just add this to the end of your alert query:
| where result_count=0
when i add where MESSAGE=0 it is not returning any result
As my intention is to check for last 15 min if two of 5 min interval does not get any result to do some other action
index=XXX name=file-XXX level<50
| bucket _time span=5m
| fillnull value=0
| stats count(msg) as MESSAGES by _time
tried this but this will provide the result as follows it skipped 3:25 when the count was 0
2021-08-18 03:20:00 | 25 |
2021-08-18 03:30:00 | 139 |
2021-08-18 03:35:00 | 10 |
The problem with you query is that you are not eliminating events where "msg" has a non null value. That's why youre getting results with counts.
Try something like this:
index=XXX name=file-XXX | fields + msg level<50
| bucket _time span=5m
| fillnull value=0
| where msg=0
| stats count(msg) as MESSAGES by _time