I want to alert based off a current value and if that value increases over a threshold within a set time.
I want to alert if I have a count of 100 and if it grows to 200 within 30 minutes. The 100 count will grow no matter what, but I want to alert if it grows a lot within a set time so we can look into what is going on or why it is growing. This will be used for licences and sourcetype alerting.
This is what i have for license usage and i want to take the Volume number and check every hour if it grew more than a set number.
index=_internal source=*license_usage.log earliest=-1d@d | foreach * [eval <<FIELD>>=round('<<FIELD>>'/1024/1024/1024, 3)] | timechart span=30m sum(b) AS "volume"
the other issue is why would the data show up like this? is there something different with the index=_internal
_time volume 2016-07-28 00:00:00 110.855 2016-07-28 00:30:00 1.222 2016-07-28 01:00:00 1.207 2016-07-28 01:30:00 1.121 2016-07-28 02:00:00 1.223 2016-07-28 02:30:00 1.202 2016-07-28 03:00:00 1.198 2016-07-28 03:30:00 1.211 2016-07-28 04:00:00 1.502
The command is autoregress. Try this query
index=_internal source=*license_usage.log earliest=-1d@d | eval b=round(b/1024/1024/1024, 3) | timechart span=30m sum(b) AS volume | autoregress volume as prev_vol | where volume>prev_vol*2
index=_internal source=*license_usage.log earliest=-1d@d | eval b=round(b/1024/1024/1024, 3) | timechart span=30m sum(b) AS volume | trendline sma2(volume) as trend | stats earliest(volume) as volume latest(trend) as trend | where volume<trend*2