Hello
I would like to make a search for a SLA who does the following: (id 700 is ok, 702 is nok)
Example:
700, 700, 702, 702, 700, 702 should count as 0, because there aren't three events with id 702 successively
700, 702, 702, 702, 700, 700 should count as 1, because there are three events with id 702 successively
How can I do that?
Thanks for your help!
Hello
You could use streamstats to sum the SLA values in groups of 3 values, and if the sum reaches 2112 (3 * 704) then thats what you need.
your base search ...| streamstats window=3 sum(SLA) as alarm | where alarm="2112" | table _time, SLA, alarm
Regards
assuming the same format, maybe, we can do a rex for "702, 702, 702"
your base search | rex field=_raw "(?<SLA>702, 702, 702)" | table SLA, _raw _time
Hello
You could use streamstats to sum the SLA values in groups of 3 values, and if the sum reaches 2112 (3 * 704) then thats what you need.
your base search ...| streamstats window=3 sum(SLA) as alarm | where alarm="2112" | table _time, SLA, alarm
Regards
Thanks a lot, one question:
We used streamstats to biuld a "package" of three events with the sum of the SLA values.
One Example:
Does the window make a package with number 1-3 oder 3-5?
This is important for the calculation.
Thanks a lot!