Create alert based on success rate per a group

[MaratD]

Hi all,

I need to create an alert based on a success rate less than a specific value. My data is as follows:

store = "store1" result= "success"
store = "store1" result= "success"
store = "store1" result= "success-with-warnings"
store = "store1" result= "failed"

store = "store2" result= "success-with-warnings"
store = "store2" result= "failed"

store = "store3" result= "success-with-warnings"
store = "store3" result= "success"

I need to calculate the success rate based on each store. Result = "success" or "success-with-warnings" are considered a success, all other result values are considered failed. For example, using the above data, the search result should be something like this:

store1 %75 success
store2 %50 success
store3 %100 success

Then I need to use those values to create an alert, that will be triggered daily to check stores with a success rate is less than 70%. So in this case, I will get an alert for store2.

[yuanliu]

This filter

| eval result = if(match(result, "^success"), "succeeded", "failure")
| stats count by store result
| eventstats sum(count) as subtotal by store
| eval percent = round(count / subtotal * 100) . "%"
| where result == "succeeded"
| table store percent result

gives something like

store	percent	result
store1	75%	succeeded
store2	67%	succeeded
store3	89%	succeeded

Here, I used "succeeded" to illustrate that it is a combined count.  You can use any word.

[ITWhisperer · Accepted solution]

Use something like this for your alert search

your search
| eventstats count as total by store
| eval success=if(result="success" OR result="success-with-warnings",1,0)
| stats sum(success) as successes values(total) as total by store
| eval success_rate=100*successes/total
| where success_rate < 70

Then set your alert to trigger if any rows are returned

[MaratD]

exactly what  I neee! thanks!