a problem about sub search

[crazyeva]

Hi~ masters
There is case as:
When events count of last 5 min is greater than an average count of 1 hour before (count-of-1h/12), trigger a email alert
I tried this:
summary index:
index="_internal" | fields | sistats count
named Count5magain1h, scheduled every 5min, then:
index=summary search_name=Count5magain1h | sort -_time limit=13 |stats count| rename count as countof65m |
eval Average = (countof65m - [search index=summary search_name=Count5magain1h | sort -_time limit=1 | stats count | rename count as countof5m | return countof5m])/12 |
eval Result=case(countof5m>2*Average,1,countof5m<2*Average,0)

this seems not going to work! I must have mistaken syntax of search
Could someone help me thanks~

[lguinn2 · Accepted solution]

So I am not sure I understand your question, but try this:

yoursearchhere earliest=-65m latest=-5m
| bucket _time span=5m
| stats count as FiveMinCount by _time
| stats avg(FiveMinCount) as avgCount
| appendcols [ search yoursearchhere  earliest=-5m
   | stats count as currentCount ]

I don't understand why you are searching the _internal index. In my example above, I have inserted yoursearchhere where your search criteria should go.

Also your custom condition on the alert should be

where currentCount > avgCount

HTH

[crazyeva]

Thank you very much! I am not good at expressing...
But that exactly solved my problem, and helped me with the usage of Splunk