I need to set one alert when more than 10 API calls Noderesponse-time is beyond threshold(5000ms)
Below is my search:
index=abc ns=gateway (nodeUrl ="*") Trace_Id=* "*" | stats count by Trace_Id Span_Id ns app_name Log_Time caller nodeUrl nodeHttpStatus nodeResponseTime |rename caller as "Caller"|rename nodeUrl as "Node" |rename nodeHttpStatus as "NodeHttpStatus"|rename nodeResponseTime as "NodeResponseTime"| fields - count|replace "https://datagraphaccountnode/graphql" with "Account" |where NodeResponseTime >5000
Can someone guide me how to set the condition for more then 10 API calls in search.
That means when more then 10 NodeResponseTime should be greater then 5000ms.
Can someone guide me how to set that condition.
Thanks in advance
Please try by adding below to the end of your search;
| stats count
| where count > 10