Hi, Need help. I want to run a query to identify if errors are increased over 10%. Data is : Servername errorcode1 errorcode2 count Abcd.1.1.1000 Pqrs.1.2.1100 If errorcode2 value 1 txns are exceeding 10% of average count of its historical(7 days) count then show alert. I need to do this for all types of available errors in a single query. I could do it for a single error code.. but i want query for all error code at once. Index=abcd errorcode2 in (1) earliest=-1d@d latest=@d |Stats coubt as t1 by errorcode2 |Table t1 | where t1 > 【 search index=abcd errorcode2 in (1) earliest=-8d@d latest=-2d@d Bucket _time span=1d |Stats count as total by _time |Stats avg(total)as avgt |Eval chk = 1.1* avgt |Table chk | return $chk】 Kindky help me understand how can I compare complete table in where condition like we do in python pandas.
... View more
