Dear Sir, I would like to set a token in order to be able modify -1h treshold.
| tstats latest(_time) as latest where index=* earliest=-24h by host
| eval recent = if(latest > relative_time(now(),"-1h"),1,0), realLatest = strftime(latest,"%c")
| eval data=case(recent=="0","No Data",recent=="1","OK")
| table host,realLatest,data
My earliest -24h token works fine, but I would like to set token alo for "-1h" relative time in order to be able modify treshold. Can you help ?
Thank you in advance.
regards,
Stives
Resolved, thaks
@Stives Request you to post what you tried which fixed the issue. Accept the answer to mark the question as answered.