How to generate a search where the count is greater than 0 after 5 days?

[nickyp86]

I need to see if errors are still continuing after 5 days. If they are there then there is an issue and I need it to be displayed. I'm not sure how to show that. Please let me know if you need additional details.

[mparks11 · Accepted solution]

Probably need more details here, but you could do your base search for "errors" and have that run for the last 5 days, then pipe those results to stats and distinct count the days over which the errors existed, then trigger an alert if that distinct count >= 5.

index=foo sourcetype=bar "error" earliest=-5d | stats dc(date_wday) as days

Save As Alert then set a Trigger Condition for when days>=5.

Something like that maybe!

[nickyp86]

This is perfect. Thank you!