How to set alert search when more than 10 API calls Noderesponse-time is beyond threshold(5000ms)

[aditsss]

Hi Everyone,

I need to set one alert when more than  10 API calls Noderesponse-time is beyond threshold(5000ms)

Below is my search:

index=abc ns=gateway (nodeUrl ="*") Trace_Id=* "*" | stats count by Trace_Id Span_Id ns app_name Log_Time caller nodeUrl nodeHttpStatus nodeResponseTime |rename caller as "Caller"|rename nodeUrl as "Node" |rename nodeHttpStatus as "NodeHttpStatus"|rename nodeResponseTime as "NodeResponseTime"| fields - count|replace "https://datagraphaccountnode/graphql" with "Account" |where NodeResponseTime >5000

Can someone guide me how to set the condition for more then 10 API calls in search.

That means when more then 10 NodeResponseTime should be greater then  5000ms.

Can someone guide me how to set that condition.

Thanks in advance

[scelikok]

Hi @aditsss,

Please try by adding below to the end of your search;

| stats count
| where count > 10