Get alerted for 4consecutive failure SUCCESS_STATUS=FAILED

[Manoj_g]

I have a base search with index , source , and the sourcetype , I want to build alert when the SUCCESS_STATUS is having 4consecutive failure's , we have different status like SUCCESS , ERROR as well.

[renjith_nair · Accepted solution]

@Manoj_g ,

Try this ,

"search to sort in the order of events"| streamstats count by SUCCESS_STATUS|where count>=4 AND SUCCESS_STATUS=="FAILED"