I've tried this a few ways with no success, I tried to just append the where condition on the end of my query so it looks something like this index="my-index" | search "http 404" | stats count | where count => 250 AND count <= 100 but this still just returns the number of matching events and I run into the same problem trying to set up the alert. I have also tried with eval to output a result like this index="my-index" | search "http 404" | stats count | eval result=if(count>=250 AND count<=500, 1, 0) | table result which properly returns 1 or 0 depending on if the number of results are in the range I am looking for, however it is still not alerting properly when the trigger is set to >1. I think the trigger is still running against the number of events which is also being returned (and I like that I can see this) and not the result I set up. . Any other suggestions would be much appreciated.
... View more
