Hi all,
I have to trigger an alert for event=1, if there is no event=2 within 30min of event=1. Search I'm using:
index="abc" (EVENT=1 OR EVENT=2)| transaction MACHINE startswith=(EVENT=1) endswith=(EVENT=2)|where duration> 1800 | table duration EVENT MACHINE NAME DESCR
It's working only if have an event=2. What is best the best way to achieve it?
Try this
index="abc" (EVENT=1 OR EVENT=2)| transaction MACHINE startswith=(EVENT=1) endswith=(EVENT=2) keepevicted=t |where duration> 1800 OR ( mvcount(EVENT)=1 AND EVENT=1)| table duration EVENT MACHINE NAME DESCR
Try this
index="abc" (EVENT=1 OR EVENT=2)| transaction MACHINE startswith=(EVENT=1) endswith=(EVENT=2) keepevicted=t |where duration> 1800 OR ( mvcount(EVENT)=1 AND EVENT=1)| table duration EVENT MACHINE NAME DESCR
Can you let me know how mvcount is working here, and if i schedule this alert to run every 5 min it will trigger when there is no event=2 within 1800s right?
mvcount is counting the number of values in a multivalued field
You can check more info here