Counter for when event occurs one or more times

[cpeteman]

I want to set up a search for when an event occurs one or more times in a minute (just whether or not it occurred not the total count). This along with sum stats functions I'll use to figure out whether or not an event is a regular check or an anomaly. As in if the stdev is zero and the sum is high and I need to check to see if there has been many events, implying that they are a regular message, or a single event implying that there is a problem.

More detail:

I have all results in a table by punct with relevant stats listed and I want one of those relevant fields to be a variable that checks whether or not an event occurred in a minute (regardless of how many times) adds those up over the entire search time and put it in the same row as that punct. Hope this makes every thing more clear.

[gkanapathy · Accepted solution]

... | bucket _time span=1m | stats count by _time,punct | eval occurred=if(count!=0,1,0) | stats sum(occurred) by punct

or

... | bucket _time span=1m | stats count by _time,punct | stats sum(eval(if(count!=0,1,0))) by punct

[cpeteman]

They appear to both work as desired thanks a bunch!

[cpeteman]

I like it. I have the: "| bucket _time span=1m | stats count by _time,punct |" part already. I'll let you know how it works

[cpeteman]

Not quite but It sounds like a good place to start (except I don't plan on this being an alert really...) so I will take a look. I added a lot more to the question to make it more clear I hope.

[linu1988]

From your case i suspect it will be a realtime thing. Put your search and schedule it from "rt - 1m" to "rt". It will keep searching the time window. If the case satisfies you can set up an alert. Hope i understand it correctly. Thanks