How to define 2 thresholds based on time?

[cbiraris]

Hi Team,

I am trying to schedule a alert base on threshold for 2 time window.

If fall to 0 events between 23:00 to 07:00
If fall to less then 20 events between   07:00 to 23:00 
 
is it possible to define 2 threshold like above ? in one alert

index=ABC sourcetype=XYZ login |stats count |where count =0 between23:00 to 07:00

index=ABC sourcetype=XYZ login |stats count |where count <=20 between 07:00 to 23:00 

Please advise.

Thank you

[ITWhisperer]

index=ABC sourcetype=XYZ login |stats count |where count=0 OR (count <=20 AND tonumber(strftime(now(),"%H")) >= 7 AND tonumber(strftime(now(),"%H")) < 23)

[gcusello · Accepted solution]

Hi @cbiraris,

yes, you have to define a threshold value using eval:

index=ABC sourcetype=XYZ login 
| stats count 
| eval time_hour=strftime(now(),"%H")
| eval threshold=if(time_hour>22 OR time_hour<8,0,20)
| where count<=threshold

Ciao.

Giuseppe

[cbiraris]

Also, can we define 2 different search run interval in this query ? like below---

index=ABC sourcetype=XYZ login |stats count |where count =0 between23:00 to 07:00, search can be run every after 2 hours to check last 2 hours events 

AND 

index=ABC sourcetype=XYZ login |stats count |where count <=20 between 07:00 to 23:00, , search can be run every after 1 hours to check last 1 hours events 
 

[ITWhisperer]

You can do this in one alert but it gets a bit messy - you would probably be better off using two alerts with different schedules, time periods and alert criteria

[cbiraris]

Thank you @gcusello, 
Its Working