Alarm Condition Creation

[daniel333]

All,

I have this search which when done displays the ipaddress of people and the number of hits they made against our site. We found that people going over 1000 hits per minute were generally fraud.

index=apache_access_logs host=apache* /myapi/myevent| timechart count by clientip

I'd like the results of that search sent to me when a clienip exceeds 1000 in a minutes time.

How do I loop through the results and run a condution of where > 1000?

[vincesesto]

Hi daniel333,

If you create a new Alert through the management interface(Manager => Searches and Reports => Add New). It will allow you to set the Alert Condition, where you can choose "if number of events" then "is greater than".

It will step you through all of the process. I hope that this is what you are looking for.

Regards Vince