Alerting on a threshold

[SecureIA]

Hi all,

I currently have a very simple search that looks at the distinct visitors for a website per day. See below,

sourcetype=iis | stats dc(cs_username)

Is there a way of converting this search to an alert which will trigger when there is an abnormally high amount of visitors?

Any help would be massively appreciated.

[twinspop]

If you want something dynamic, you could use timechart + delta + stream stats. Something along these lines:

sourcetype=iis earliest=-6m@m latest=@m|
  timechart span=1m dc(cs_username) as DU |
  delta DU as Delta |
  streamstats window=5 current=f global=t avg(Delta) as AvgLast5Delta |
  eval PercentageChange=100*round((AvgLast5Delta-Delta)/AvgLast5Delta,4) |
  tail 1

Alert on (absolute?) PercentageChange being bigger than some number.

EDIT: Made PercentageChange an actual percentage

[DMohn]

You can always select the "Save as" option (right top, above the time range picker) and save the search as an alert.

If you want the alert to trigger as soon as the dc(cs_username) exceeds a certain number, change the Alert type to Real-time, and set the needed trigger conditions.

Then you can add an alert action to this alert (could be email, script, ...)