How to set up an Alert when the count exceeds 100 in a week?

[Rapidz]

I am setting up an alert to notify when a message is received more than a 100 times in a week. I figured it out for the total, but not within a week time range. Any help is appreciated.

'Bitgo webhook error' | stats count as Bitgo_Webhook_Errors | where Bitgo_Webhook_Errors >=100

[richgalloway]

It depends on how the search is used.  Either limit the search to a single week or break the results into one-week chunks.

Search a single week:

'Bitgo webhook error' earliest = -1w
| stats count as Bitgo_Webhook_Errors 
| where Bitgo_Webhook_Errors >=100

The exact placement of the earliest option depends on the definition of the macro - the option may have to go inside the macro.  Also, the relative time setting may need adjustment depending on whether you want to search the last 7 days or the previous Sun-Sat.

To break the results into chunks:

'Bitgo webhook error' 
| bin span=1w _time
| stats count as Bitgo_Webhook_Errors by _time
| where Bitgo_Webhook_Errors >=100

Again, the "1w" may have to change depending on your definition of a week.

[Rapidz]

@richgalloway 

When you say the placement of the of the earliest option may have to be moved, does it just have to move for the earliest command gets highlighted pink? The only way it gets highlighted pink is if it is formatted like this:

'Bitgo webhook error' 
| stats count as Bitgo_Webhook_Errors earliest = -1w
| where Bitgo_Webhook_Errors >=100

I want to make sure I am understanding you properly, for this search will trigger when necessary. 

Thanks for the help!

[richgalloway]

The earliest option is valid only with the search command.  That usually means it must be before the first pipe.  Note that the first pipe might be inside the macro.

[Rapidz]

@richgalloway 

Ok that makes sense, So in my case does this look right?

[richgalloway]

Maybe.  It depends on the definition of the macro.  Type CTRL-Shift-E in the SPL box to see the expanded macro.