How to create an Alert for an increase in IIs requests compared to a previous date

[joe06031990]

Hi,

I’m looking at creating Alert for an increase in IIs requests compared to a previous date based on a percentage.

just wondered if this was possible?

thanks,

joe

[yuanliu · Accepted solution]

At the very minimum, you can do something like

| where _time - relative_time(now(), "-4d@d") < 0 AND _time - relative_time(now(), "-5d@d") > 0 OR _time - relative_time(now(), "-0d@d") < 0 AND _time - relative_time(now(), "-1d@d") > 0
| bin _time span=1d
| stats count by _time
| delta count as delta
| where delta/(count - delta) > 0.3

Here, count in the previous day (between -0d@d  and -1d@d ) is compared with that in the -5th day, and return a stat if the delta is larger than 30%.  To calculate for events during the current day, replace _time - relative_time(now(), "-0d@d") < 0 AND _time - relative_time(now(), "-1d@d") > 0 with relative_time(now(), "-0d@d") > 0.

[joe06031990]

Thanks