Hi,
I’m looking at creating Alert for an increase in IIs requests compared to a previous date based on a percentage.
just wondered if this was possible?
thanks,
joe
At the very minimum, you can do something like
| where _time - relative_time(now(), "-4d@d") < 0 AND _time - relative_time(now(), "-5d@d") > 0 OR _time - relative_time(now(), "-0d@d") < 0 AND _time - relative_time(now(), "-1d@d") > 0
| bin _time span=1d
| stats count by _time
| delta count as delta
| where delta/(count - delta) > 0.3
Here, count in the previous day (between -0d@d and -1d@d ) is compared with that in the -5th day, and return a stat if the delta is larger than 30%. To calculate for events during the current day, replace _time - relative_time(now(), "-0d@d") < 0 AND _time - relative_time(now(), "-1d@d") > 0 with relative_time(now(), "-0d@d") > 0.
At the very minimum, you can do something like
| where _time - relative_time(now(), "-4d@d") < 0 AND _time - relative_time(now(), "-5d@d") > 0 OR _time - relative_time(now(), "-0d@d") < 0 AND _time - relative_time(now(), "-1d@d") > 0
| bin _time span=1d
| stats count by _time
| delta count as delta
| where delta/(count - delta) > 0.3
Here, count in the previous day (between -0d@d and -1d@d ) is compared with that in the -5th day, and return a stat if the delta is larger than 30%. To calculate for events during the current day, replace _time - relative_time(now(), "-0d@d") < 0 AND _time - relative_time(now(), "-1d@d") > 0 with relative_time(now(), "-0d@d") > 0.
Thanks