Is it possible to use streamstats over a 3 minute window over a 9 minute search to pick up three consecutive events?

[becksyboy]

Hi I have an ask to create an alert that must trigger if there are more than 50 '404' status codes in a 3 min period. This window must repeat three times in a row - for e.g 9:00 - 9:03, 9:03 - 9:06, 9:06 - 9:09.   The count should trigger only for those requests with 404 status code and for certain urls. The alert must only trigger if there are three values over 50 in consecutive 3 min windows.

I have some initial SPL not using streamstats, but was wondering if streamstats would be better?

Initial SPL - run over a 9 min time range:

index="xxxx" "httpMessage.status"=404 url = "xxxx/1" OR url="xxxx/2" OR url ="xxxx/3"
| timechart span=3m count(httpMessage.status) AS HTTPStatusCount
| where HTTPStatusCount>50
| table _time HTTPStatusCount

thanks.

[ITWhisperer · Accepted solution]

What you are doing will work fine assuming your alert is triggering is there are 3 results i.e. all of the 3 minute slots in your 9 minute period have counts greater than 50.

Using streamstats would give you something different and doesn't quite fit with your stated requirement.

[becksyboy]

Thanks for the additional validation on my initial search.

[isoutamo]

It exactly this way. The key word here is fixed window or sliding window. With fixed window time chart is correct way to do it, but if you need to look those event in sliding window (it change start and end time continuously based on current event) then you must use stream stats.