About alvarezmj

alvarezmj · ‎04-02-2015

Awesome. SO I can just change the "earliest=" condition to be 30d to check the count against the daily average over the last month? index=indexA sourcetype=sourcetypeA earliest=-30d@d latest=@d | stats count as Month | appendcols [search index=indexA sourcetype=sourcetypeA earliest=@d latest=now | stats count as Today ] | where Today>=1.5*Month

alvarezmj · ‎04-02-2015

The whole point is so that we can be notified that A. There was a massive increase in # logged events. B. React to a sudden increase accordingly or at least look into it

alvarezmj · ‎04-02-2015

I want to create an alert that will notify me when there is a X% increase in the total amount of events in a time period (ie X% frequency increase). I can't seem to find out how to connect this data to pull this all together, specifically I cannot figure out how to connect the frequency of events during current time period against the total average # events per day. Any help is greatly appreciated.

Posts	3
Solutions	0
Karma Given	3
Karma Received	3
Member Since	‎02-26-2015

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Alert when there is a X% increase in all events du...

Re: Alert when there is a X% increase in all event...

Re: Alert when there is a X% increase in all event...

Alert when there is a X% increase in all events du...