we need to setup alert for montoring java processes

[jenniferhao]

we need to set up an alert if a server no java process for 15mins, only one alert was sent until the issue was solved. Do we need to create 2 windows for this?
| mstats count(os.cpu.pct.used) as c where index=cpet-os-metrics host_ip IN (10.0.0.1,10.0.0.2) by  host_ip
| join host type=left
    [| mstats avg(ps_metric.pctMEM) as avg_mem_java avg(ps_metric.pctCPU) as avg_cpu_java count(ps_metric.pctMEM) as ct_java_proc where index=cpet-os-metrics host_ip IN (10.0.0.1,10.0.0.2) sourcetype=ps_metric COMMAND=java by host host_ip COMMAND USER ]
| fields - c
| eval is_java_running = if(ct_java_proc>0, 1, 0)

[inventsekar]

Hi @jenniferhao .. i am not much sure of whether two windows or one window, but lets do troubleshooting...
could you pls update us what output you get..

from the results, you can decide about next steps.. thanks. 

| mstats count(os.cpu.pct.used) as c where index=cpet-os-metrics host_ip IN (10.0.0.1,10.0.0.2) by  host_ip
| join host type=left
    [| mstats avg(ps_metric.pctMEM) as avg_mem_java avg(ps_metric.pctCPU) as avg_cpu_java count(ps_metric.pctMEM) as ct_java_proc where index=cpet-os-metrics host_ip IN (10.0.0.1,10.0.0.2) sourcetype=ps_metric COMMAND=java by host host_ip COMMAND USER ]
```| fields - c 
commenting the above fields command for a testing```
| eval is_java_running = if(ct_java_proc>0, 1, 0)