I have the below query which gives me the count of alerts over period of an hour, I wanted to make it as an alert by adding a where clause and display only those host names whose value is more than 4 in the given time period of 1 hour index="mail" alert_type="Danger" | eval firsttime=strptime(time_triggered, "%m/%d/%y %H:%M:%S") | eval hour=strftime(firsttime,"%H") | chart count(host_info) as count_of_host by hour host_info | fields - NULL This gives below result hour Host1 Host2 04 1 4 10 1 3 The result I want is hour Host2 04 4 Also time_triggered is not same as _time. Please help. ... View more

I have a lookup file assignment_schedule containing below sample data assignment_group task_order schedule available_mins_weekdays available_mins_weekends rxpress Ecommerce Avail:24x7 Maint:N/A 7200 2880 I need to evaluate the number of available mins in a month and for that have another lookup , calculation will be (available_mins_weekdays/5)*weekdays month saturday sunday weekdays days Jan 4 5 22 31 I expect data to be in form assignment_group month available mins abc Jan 22*(7200/5) I am trying below query but it is not giving me results |inputlookup assignment_schedule | join type=outer assignment_group [search index="JUNK" sourcetype=applications [search index=test source=month_data.csv| eval wk_min=(available_mins_weekdays/5)*weekdays ] ... View more