i have a below data generated by a timechart i'm trying to write a query where if there are continous sequence of number 1 in a span of 15 mins it should alert me
index=abc "Heartbeat*" |timechart span=2m count
2021-10-04 10:20:00 | 1 |
2021-10-04 10:22:00 | 1 |
2021-10-04 10:24:00 | 1 |
2021-10-04 10:26:00 | 1 |
2021-10-04 10:28:00 | 1 |
when the
Give this a try
index=abc "Heartbeat*" |timechart span=2m count
| streamstats current=f window=1 values(count) as prev_count
| stats sum(eval(abs(count-prev_count))) as diff
| where diff=0
Basically comparing every row's count value with previous row's count value and checking if difference is 0 (means they're all same).
There is a command especially for using previous values - autoregress
So checking if the value is the same as previous one is easier:
<your-search> | autoregress field
| where field=field_p1
But I think I'd use a transaction here. With resetonchange=t