About Goldenfit

Goldenfit · ‎06-28-2023

So I have this query that creates and incident if there is 7 outlier in the last 15 minutes: | streamstats time_window=15m current=true reset_after=(propOutlier=7) sum(isOutlier) as propOutlier by InterfaceName | eval isIncident = if(propOutlier=7, 1, 0 ) | eventstats max(isIncident) as hasIncident by InterfaceName | where hasIncident=1 Now i would like the add to "isIncident" the situation where there has been 5 outliers, repeteadly, in the last 3 time window of 15 minutes. If there has been 5 outliers in the last 15min window, I do not care. But if this happens 3 times in a row, it is a problem for me. Can anyone help? Thank you

gcusello · ‎06-02-2023

Hi @Goldenfit, timechart command works only if you have the _time fields. But you haven't this field. You could use the stats command using CURRENT_TIMESTAMP as grouping BY option. In addition, join is a command to use only when you haven't any other solution and having few events, otherwise it's a very slow command; I hint to you to re-design your search using stats. Ciao. Giuseppe

richgalloway · ‎05-30-2023

The where command returns no results because there is no message_id field in the data. The field was stripped out by the stats command. Perhaps moving where before stats will give you the results you seek.

Goldenfit · ‎05-17-2023

So basically i have another panel my goal is that when I click on one of the message_id displayed in the chart above, my first query in the original post udates it to display TEXT and USER with this particular message_id

Posts	5
Solutions	0
Karma Given	2
Karma Received	0
Member Since	‎05-16-2023

Online Status	Offline
Date Last Visited	‎06-28-2023 05:20 PM

Finding a number of outliers that repeteadly occur...

How to timechart with join>

How to fix token with a field created using "eval"...

How to use token with a field created with "eval"?

Finding a number of outliers that repeteadly occur...

Re: Timechart with join

Re: using token with a field created using "eval"

Re: Using token with a field created with "eval"?