How to find the application is running ?

[Real_captain]

Hi Team 

Can someone help me to create a dashboard panel which will highlight an alert when the 
Incoming > 0 and Outgoing = 0 in last 30 mins. 

Requirement is to highlight an alert in the dashboard when the processing is not done in last 30 mins. 

Query to find the incoming (IN_per_24h) and outgoing (OUT_per_24h) is fetched using the below query: 
|tstats count(PREFIX(nidf=)) as t where index=events_prod_cdp_penalty_esa source="SYSLOG"

(TERM(NIDF=RPWARDA) OR TERM(NIDF=SPWARAA) OR TERM(NIDF=SPWARRA) )
by _time PREFIX(nidf=) span=5m
| rename nidf= as NIDF | eval NIDF=UPPER(NIDF)
| eval DIR = if(NIDF="RPWARDA" ,"IN","OUT")
| timechart span=5m sum(t) by DIR
| eval DAT_rel = relative_time(_time, "+3h")
| eval day_of_week=lower(strftime(DAT_rel, "%a"))
| eval DAT_rel = if(day_of_week = "sun", relative_time(DAT_rel, "+1d"),DAT_rel)
| eval DAT_rel = if(day_of_week = "sat", relative_time(DAT_rel, "+2d"),DAT_rel)
| eval DAT = strftime(DAT_rel, "%Y/%m/%d") 
| streamstats sum(*) as *_per_24h by DAT reset_on_change=true
| eval backlog = (IN_per_24h - OUT_per_24h )
| table _time IN_per_24h OUT_per_24h backlog

[Real_captain]

Hi 

Is it possible to use any graph/visualization to show that in last 30 mins 
INCOMING is greater than 0 and OUTGOING = 0 . 

[ITWhisperer]

Technically, yes it is possible (probably), but it is not simple. Visualisations work on series i.e. all points / bars from the same series are shown in the same colour, so what you could do is duplicate the incoming series and in one copy of the series set the value to zero if the out going count is create than zero and in the other series set the value to zero if the outgoing count is zero.

Using random generated values, this demonstrates what I mean

| gentimes start=-1 increment=1h
| rename starttime as _time 
| fields _time
| eval incoming=random()%10
| eval outgoing=random()%10
| eval unprocessed = if(outgoing > 0, 0, incoming)
| eval incoming = if(outgoing > 0, incoming, 0)

[ITWhisperer]

Given that you already have 5 minute counts, do you want a rolling 30 minutes i.e. 6 event window? If so, you could use something like this:

| streamstats sum(*) as *_last_30mins window=6