Thanks, @gcusello, I already tried with time chart, but if I've a lot of application which work in this way, I'm not able to work with timechart, also because if I wanto to work with data after time...
See more...
Thanks, @gcusello, I already tried with time chart, but if I've a lot of application which work in this way, I'm not able to work with timechart, also because if I wanto to work with data after timechart I cannot. Maybe better so: DATE,APP 2024/05/24 11:04:00, APPA 2024/05/24 11:05:00,APPB 2024/05/24 11:06:00,APPA 2024/05/24 11:08:00,APPB 2024/05/24 11:09:00,APPA 2024/05/24 11:10:00,APPB 2024/05/24 11:11:00,APPA 2024/05/24 11:13:00,APPB 2024/05/24 11:14:00,APPA So I've to highlight this condition of "flapping" in 10 minutes. If The app is present, it means that it's not respondig. index=myindex | timechart span=1m by APP produces: _time, APPA, APPB And what I want to produce _time, APPA, APPB 2024/05/24 11:04:00, 1,0 2024/05/24 11:05:00, 0,1 2024/05/24 11:06:00, 1,0 2024/05/24 11:07:00,0,0 2024/05/24 11:08:00, 0,1 2024/05/24 11:09:00, 1,0 2024/05/24 11:10:00, 0,1 2024/05/24 11:11:00, 1,0 2024/05/24 11:12:00,0,0 2024/05/24 11:13:00, 0,1 2024/05/24 11:14:00, 1,0 But I want to work with this output in order to send alert to other application. Thanks