Hi Team,
There is an requirement in writing the search query. i.e.
index=xyz host=abc source=mno "Server starting" .
Actually the keyword "Server Starting" would be there atleast as 4 events in a minute. So i want the query to be in such a way of the keyword "Server Starting" is not present in the log for last 5 minutes then it needs to trigger an alert.
So in a minute the keyword "Server Starting" would be surely captured for 4 times atleast. So if the keyword is not present in the log for 5 minutes then it needs to trigger an alert.
So kindly help on the query.
Like this:
index=xyz host=abc source=mno "Server starting"
| streamstats count time_window=1m
| where count <= 4
@anandhalagarasan ,
Try
index=xyz host=abc source=mno "Server starting"
|stats latest(_time) as _time
|eval delay=round((now()-_time)/60,2)|appendpipe [stats count|where count=0|eval delay=9999999]
|where delay >5
appendpipe
is required in case you dont have the events for the selected time range. In that case , the result will be empty and the where condition evaluates to false.
@renjith.nair
Thanks for your swift response.
When I used your query and ran for all time the result seems to be showing as count=0 and delay=9999999
But my requirement is that if the keyword is not present in last 5 minutes of log then we need to get an alert.
So kindly let me know.
@anandhalagarasan ,
That indicates that you dont have the event which satisfies the condition. Do you have any events which has "Server starting" in it ?
Just to be sure , index, host and other search terms have to be adjusted to your actual value