Try this:
sourcetype=xyz or whatever
| stats count(eval(status="success")) as successCount count(eval(status="error")) as ErrorCount
and use a custom condition for your alarm: errorCount >= successCount
However, the above will only work if the basic search on the first line is the same for both successes and errors. Also, the eval function is case-sensitive, so make sure that the values success/error are actually lower-case.
What if your successes are recorded in one log file but errors come from a different source? Here's a solution when the two base searches are different. It isn't as efficient, though:
sourcetype=abc status=success
| stats count as successCount
| appendcols [ search sourcetype=xyz status=error
| addinfo | where _time >= info_min_time AND _time <= info_max_time
| status count as errorCount ]
And you would use exactly the same custom condition: errorCount >= successCount
What is all that addinfo and other stuff? Well, the second solution uses a subsearch. The subsearch will run over all time unless you provide a time range. The addinfo and where commands retrieve the time range of the first search and apply it to the subsearch.
Hope this helps!
