Blacklists and whitelists are unanchored regular expressions. In regular expressions the period (.) is a wild-card representing a single character. If you want to specify the period, it should be "escaped" with a backslash like this example blacklist=.\d+$ which means "do not index any file whose name ends in a period followed by one or more digits." ... View more

Try this: index=webex_sentiment surveyDate=* Rating=* | eval surveyDate=strptime(Started,"%m/%d/%Y %H:%M") | eval YearWeek=strftime(surveyDate,"%Y-%U") | search YearWeek!="2016-00" | eval Rating = "Rating" . Rating | chart count by YearWeek Rating | addtotals fieldname=NumberRatings Rating* | eval NegativeSentiment = Rating1 + Rating2 | fields YearWeek NumberRatings NegativeSentiment | streamstats window=5 avg(NegativeSentiment) as MovingAverage_NegativeSentiment It is slightly different, but should do the same thing. streamstats calculates a moving average based on the current value plus the previous five values, but you could change that as you like. I just wanted to show an alternative. ... View more

If this is the whole log, then it looks like you want one event per file. Try this in props.conf [yoursourcetypehere] BREAK_ONLY_BEFORE=^**************************************************$ TIME_PREFIX = DATE\: MAX_TIMESTAMP_LOOKAHEAD = 200 TIME_FORMAT = %m/%d/%Y ********************************************* TIME: %H:%M %p You may have to tweak this a bit to get it right for your log file. ... View more

Try this: Go into the Monitoring Console set up page - check that everything is okay - and click Apply Changes. Even if you don't change anything, click on Apply Changes (or save or whatever it is called in your version.) Perhaps something changed along the way (who knows what) and the Monitoring Console settings just need to be refreshed. I have had this problem a few times. Let us know if that doesn't work. ... View more

There are lots of ways to approach this - but the first question is: how do you define the daily average? Do you want to take into account the variability throughout the day? For example, perhaps the number of attempts averages 1000 at 09:00 but 500 at 22:00 Depending on your answer to this question, establishing your alert threshold on-the-fly could get pretty expensive. One solution would be to create a lookup table of the thresholds, perhaps like this: index=x sourcetype=asa your search here earliest=-30d@d latest=@d | eval hour=strftime(_time,"%H") | bin _time span=d | stats count by _time hour | stats avg(count) as Average stdev(count) as StdDev by hour | outputlookup thresholds_lookup Schedule this search to run once a day, to update the thresholds. Or just manually create a lookup table where you specify what you want for a threshold. Now you don't need to calculate the average or std deviation repeatedly, you can just look it up. Then, create a search that actually alerts you - maybe run it once an hour: index=x sourcetype=asa your search here earliest=-1h@h latest=@h | bin _time span=1h | stats count by _time | eval hour=strftime(_time,"%H") | lookup thresholds_lookup hour OUTPUT Average StdDev | where count < (Average - (2*StdDev)) OR count > (Average + (2*StdDev)) | table _time count Average StdDev And alert when the number of results > 0 I hope this gives you some ideas. Oh and here is the documentation for the outputlookup command to get you started... ... View more

I suggest this revision: index=* (EventCode=4624 OR EventCode=4625) | bin _time span=5m as minute | stats count(Keywords) as Attempts, count(eval(match(Keywords,"Audit Failure"))) as Failed, count(eval(match(Keywords,"Audit Success"))) as Success by minute Account_Name | where Attempts>=10 AND Success>0 AND Failed>=2 | eval minute=strftime(minute,"%H:%M") You will need to create a trigger for the alert on "number of results > 0" Also, if you are setting this up as an alert, how often are you running this search and over what timerange? ... View more