Want to alert when a customer's usage suddenly drops.
Tried breaking recent usage into two time periods:
- "new" events (the previous 10 minutes)
- "old" events (the 10 minutes before that)
If there are 100 more "old" events than "new" events, I want to raise an alert.
I have tried several approaches, and found the problem unexpectedly tricky. Please help.
note: All events have a "customer" field, which is one of a couple hundred values. It should be possible to have one query that checks all customers, and returns those that have problems.
sourcetype=web | eval kind = case(_time>now()-600, "new", _time>now()-1200, "old", true(), "out of scope") | stats count by customer, kind | .... something??
sourcetype=web | stats count by customer | eval new_event_count = [search sourcetype=web earliest=-10m | stats count | where customer=customer ??? | return $count] |
Try like this
| eval period=if(_time>=relative_time(now(),"-10m@m"),"new","old")
| chart count over customer by period
| where old-new>100
View solution in original post
Thanks, this works great!