About Sam1

Sam1 · ‎06-30-2020

Or can i create another search which calls the search you provided Something like savedsearch but i want to iterate through multiple values of my field. I'd need to add the field to the search you provided i guess as well: index=_internal field=$value$

Sam1 · ‎06-30-2020

Thank you! I'm now trying to work out how to do this with | timechart span=1m count by $field$ Any ideas? Do i need to have an addtotals for each field value? And once i get to tail -1, can the values be grouped in rows by the field value?

Sam1 · ‎06-28-2020

To give some more detail of my search, it takes the field value and look at the past hour of data, compares that to the past week of data to get the percent difference. Then show result where diff > x. This needs to done for each field value though and I don't know how to do that without a lot of evals, addtotals, etc. I want to be able to do a nice clean short search regardless of the field value, and pass in the field value. Thanks.

Sam1 · ‎06-28-2020

Hi, I've created a search which is based on 1 field value but I need the search to run over many field values. Rather than many repeating lines. What is the best way to do this? I know what the field values are before the search too. It will be an alert where if 1 or more field values match the end criteria, an email is sent. I only want 1 email, not 1 for every field value. Thanks!

Sam1 · ‎06-22-2020

Thank you. How about to get a true 60 minutes? So if i was to run my search at 3:11 it would capture from 2:11 - 3:11?

Sam1 · ‎06-22-2020

Hi everyone, I want to create an alert which runs every hour, checks the last 60 minutes of events to get the count number, then compares this with the average of the past 7 days. index=data | timechart span=1h count | timewrap d series=short | addtotals s* | eval 7dayavg=Total/7.0 | table _time, _span, s0, 7dayavg | rename s0 as now This displays every hour for today and 7dayavg but how do i just show for the past 60 minutes, then compare that with the 7dayavg of the same 60 minute time block?

Posts	6
Solutions	0
Karma Given	1
Karma Received	0
Member Since	‎06-22-2020

Online Status	Offline
Date Last Visited	‎06-30-2020 06:51 PM

Iterate search over multiple field values

How to timewrap using the last 1 hour and check th...

Re: How to timewrap using the last 1 hour and chec...

Re: How to timewrap using the last 1 hour and chec...

Re: Iterate search over multiple field values

Iterate search over multiple field values

Re: How to timewrap using the last 1 hour and chec...

How to timewrap using the last 1 hour and check th...

Join the Conversation