Conditional search evaluation

[Tanmaya]

Hi , 

I am trying to get the day wise error count by data message only if the yesterdays error count is more than 50 .

index="eshop" NOT(index=k8*dev OR index=k8*test) tag=error
| eval time=strftime(_time,"%Y-%m-%d")
|table time,data.message

<condition if the previous day data message count is less than 50 then it should be ignored from the stats>
| stats count by time,data.message

[PickleRick]

Don't split by time manually. That's what timechart is for. It works similarily but a bit different.

If you bin manually by date, you have no good way to find days in which there was no events (you have to do tricks with generating artificial entries with count of zero) and therefore you can check agains "previous" value but it doesn't necessarily be the value from the day before. (Unless that's exactly what you want to do, but that's another story)

So instead of manipulating with date just do

| timechart span=1d count by data.message

Now you can't filter by value from another row. You have to get the value from another row into your row. There's a command for it - autoregress. But in order for it to work properly, you have to sort the data in the right order.

| sort data.message _time

Now you can get your previous values for comparison

| autoregress data.message count

And filter out the ones we don't want

| where NOT (data.message=data.message_p1 AND count_p1>50)

[gcusello]

Hi @Tanmaya,

did you tried something like this?

index="eshop" NOT(index=k8*dev OR index=k8*test) tag=error earliest=-1@d latest=@d
| stats count BY data.message
| where count>50

Only one question: do you want to alert if any message count is more than 50 or sone spoecified messages?

Ciao.

Giuseppe

[Tanmaya]

Thanks for the response ... 

I am trying to create a dashboard with the error count line graph where i want to include only those data messages whose previous day count is more than 50 

example :Trells line graph 

if the yesterdays error for 404 is less than 50 i don't want to include 404 error message for plotting the graph

if the yesterdays error for 417 is greater than 50 then  want to include 404 error message for plotting the graph  

errorA : 40

errorB:55

errorC:55

Get the stats count only for errorB and errorC

[gcusello]

Hi, @Tanmaya,

in this case the above search should be ok for your needs, did you tried it?

Let me know and, if correct, please accept it for the other people of Community.

Ciao.

Giuseppe

P.S.: Karma Points are appreciated by all the contributors. 😉