This will return only the servers with more than 10 events: tag=failure | dedup _raw | stats count by CmcHost | search count > 10 This will only return rows where the count is greater than 10. Then, you can alert if number of events(rows returned by the search) is greater than zero. ... View more

This should give you the results you want: cluster=cluster_1 | bucket _time span=5m | stats count(eval(relay=relayhost1 AND eventtype=relay)) as "Relay Count", count(eval(reject="554 5.7.1 Service unavailable")) as "Reject Count", count(eval(categorization="spam-confirmed" OR reject=551)) as "Spam" by _time ... View more

This should get you part of the way there. Not sure if it is more efficient than what you are currently doing. sourcetype=yoursourcetype | eval steptime= _time | transaction UserLogin | mvexpand steptime | sort UserLogin, -steptime | streamstats count as seq by UserLogin | delta steptime as StepDuration | eval StepDuration=abs(StepDuration) | eval StepDuration=if(seq=1,0,StepDuration) | convert ctime(steptime) as StepTime | table _time UserLogin Page steptime StepTime StepDuration Note that the transaction command automatically creates the duration and eventcount fields for an entire transaction. Sort on -steptime is so that the results of the delta command end up with the appropriate page/event. This does not account for the third page in your posted question. The last page in any set would have a StepDuration of zero. If you want to eliminate certain StepDurations from the results you can add a search command. sourcetype=yoursourcetype | eval steptime= _time | transaction UserLogin | mvexpand steptime | sort UserLogin, -steptime | streamstats count as seq by UserLogin | delta steptime as StepDuration | eval StepDuration=abs(StepDuration) | eval StepDuration=if(seq=1,0,StepDuration) | search StepDuration > 120 AND StepDuration < 1800 | convert ctime(steptime) as StepTime | table _time UserLogin Page steptime StepTime StepDuration ... View more

I would modify the search slightly. index=_internal source="metrics.log" group=per_index_thruput series!=_ | eval totalGB = (kb/1024)/1024 | timechart span=1d sum(totalGB) as SUMTOTALGB | rangemap field=SUMTOTALGB low=0-13 elevated=13-16 severe=16-9999 default=None And use the following in the Alert custom criterion: search SUMTOTALGB > 8 ... View more

Have you tried streamstats to create a sequence number? "your search" | streamstats count as seq by sessionID | search seq > 3 AND seq < 8 ... View more

The replace() function should help: sourcetype="etrexacclog" | eval myfield="$instance$" | eval myfield=replace(myfield,":",".ad.com:") | where like(instance,"$instance$") OR like(instance,myfield) ... View more

Assuming clientpc is an IPAddress, I would try the append command to gather the events from your 3 searches and then pipe to the transaction command to correlate. In order for the transaction command to correlate based on field names, you need to change "clientpc" to "IPadr" and also change "switch_mac" to "Mac_adr". (Make sure the spelling of the Ip address and Mac address fields match.) Include your 3 searches (without the stats commands) in the framework below: "Your first search" | append [search "Your second search"] | append [search "Your third search"] | transaction Mac_adr IPadr ... View more