This query returns the url with errors at 5m span, I just want to filter out those errors that occur at consecutive intervals, like 9:00 and 9:05.
index = index uriPath=url* |bin span=5m _time
I stats count as Volume, count(eval(httpCode<=299)) as "Success" , count (eval (httpCode>399)) as Fail by urlPath _time I eval F=round (Fail*100/Volume, 2) | where FP> 2 and Volume > 50
index = index uriPath=url* |bin span=5m _time
I stats count as Volume, count(eval(httpCode<=299)) as "Success" , count (eval (httpCode>399)) as Fail by urlPath _time I eval F=round (Fail*100/Volume, 2) | where FP> 2 and Volume > 50
| streamstats range(_time) as gap
| where gap > 300