I am working on a search which triggers when the total failures by users is greater than 10 in last 30min. My result should capture the failures for each user and also the total failures count.
My search | stats count by users | addtotals col=t labelfield=users
The result of this search is
How do I need to set up a trigger condition so that all the above values are captured and the alert should be triggered when Total>10
Thanks in advance
Try like this (since we included the check in query itself, your alert condition should be 'if number of events is greater than 0'
My search | stats count by users | eventstats sum(count) as Total | where count>10
| appendpipe [| stats max(Total) as count | eval users="Total" ] | fields - Total
View solution in original post
I think you would have an easier time just looking at the total count of events in the alert trigger action. If you create an alert and select:
Trigger alert when: Number of results
is greater than: 10
That has worked. Thanks