(index=logs OR index=audit) AND source="commtasks-logger" AND id=finishedcommtask |stats count by data.succeeded | transpose header_field="data.succeeded" | eval false perc = (f/(f+t))*100 | eval true perc = (t/(f+t))*100 This my query based on this how to write a condition is "false perc >10" trigger alert Please help me anyone ... View more

Am using HEC.. SERVER busy condition HEC Queue size incresing What was the queue size.. Is any another way to reduce server busy condition ... View more