How to write a query to have count of time where time is greater than 20s hits of one field "Time " against total time hits "Time" ,to create alert .

[guru865]

here is a search i'm using for one alert.

sourcetype=xx  source="*yy"   method=*  timeDiff|    eval Time=ltrim(rtrim(timeDiff,"S"),"PT") | stats count(Time) as Total_Hits | search Time>20

The above search fulfills the alert request to get the total hits where time is greater than 20 s.

I would like to have the count of total hits on whole and greater than 20 s hits and would like to trigger the alert .

Thanks

[woodcock]

Like this:

sourcetype=xx  source="*yy"   method=*  timeDiff |  eval Time=ltrim(rtrim(timeDiff,"S"),"PT")
| stats count(eval(Time>20)) AS Time20Plus | search Time20Plus>20

[somesoni2 · Accepted solution]

How about this. This alert query will return result (so you can alert when 'number of events greater than zero') when there are events with Time>20.

sourcetype=xx  source="*yy"   method=*  timeDiff
| eval Time=ltrim(rtrim(timeDiff,"S"),"PT") 
| stats count as Total_Hits count(eval(Time>20)) as AlertField
| where AlertField>0
| rename AlertField as "Hits_With_Time>20"

[guru865]

Thanks alot somesoni2.

[DalJeanis]

At the very least, you need to test against the name of the field that you just created, because after the stats command, the field Time no longer exists.

 | stats count(Time) as Total_Hits | search Total_Hits>20

more likely, you want

| stats count(eval(Time>20)) as Hits20 count as HitsTotal

Here's some test code you can play with -

|makeresults | eval Time="20 45 1 4 13 25 71 819 12" | makemv Time |mvexpand Time 
| stats count(eval(Time>20)) as Hits20 count as HitsTotal