How to edit my alert search to set a trigger condition based on field value?

[guru865]

Hi all,

I am working on a search which triggers when the total failures by users is greater than 10 in last 30min. My result should capture the failures for each user and also the total failures count.

My search | stats count by users | addtotals col=t labelfield=users    

The result of this search is

user1      3 
user2      1
user3      12
Total      16

How do I need to set up a trigger condition so that all the above values are captured and the alert should be triggered when Total>10

Thanks in advance

[jpolcari]

I think you would have an easier time just looking at the total count of events in the alert trigger action. If you create an alert and select:

Trigger alert when: Number of results
is greater than: 10

[somesoni2 · Accepted solution]

Try like this (since we included the check in query itself, your alert condition should be 'if number of events is greater than 0'

My search | stats count by users | eventstats sum(count) as Total | where count>10
| appendpipe [| stats max(Total) as count | eval users="Total" ] | fields - Total

[guru865]

That has worked. Thanks