Grouping Events by Both Time and Customer

[DGray]

Hi all,

Want to alert when a customer's usage suddenly drops.

Tried breaking recent usage into two time periods:
- "new" events (the previous 10 minutes)
- "old" events (the 10 minutes before that)

If there are 100 more "old" events than "new" events, I want to raise an alert.
I have tried several approaches, and found the problem unexpectedly tricky. Please help.

note: All events have a "customer" field, which is one of a couple hundred values. It should be possible to have one query that checks all customers, and returns those that have problems.

sourcetype=web | eval kind = case(_time>now()-600, "new", _time>now()-1200, "old", true(), "out of scope") | stats count by customer, kind | .... something??

sourcetype=web | stats count by customer | eval new_event_count = [search sourcetype=web earliest=-10m | stats count | where customer=customer ??? | return $count] |

[somesoni2 · Accepted solution]

Try like this

sourcetype=web earliest=-20m@m 
| eval period=if(_time>=relative_time(now(),"-10m@m"),"new","old") 
| chart count over customer by period
| where old-new>100

[DGray]

Thanks, this works great!