Dear Sir, I would like to set a token in order to be able modify -1h treshold. | tstats latest(_time) as latest where index=* earliest=-24h by host | eval recent = if(latest > relative_time(now(),"...
See more...
Dear Sir, I would like to set a token in order to be able modify -1h treshold. | tstats latest(_time) as latest where index=* earliest=-24h by host | eval recent = if(latest > relative_time(now(),"-1h"),1,0), realLatest = strftime(latest,"%c") | eval data=case(recent=="0","No Data",recent=="1","OK") | table host,realLatest,data My earliest -24h token works fine, but I would like to set token alo for "-1h" relative time in order to be able modify treshold. Can you help ? Thank you in advance. regards, Stives