I had a similar issue where I needed to find spans of time where the logs I was looking for dropped to 0 to represent a potential outage. I used the `timechart` like what was described but then used `untable` to get it back into a usable format for my purposes. `Base search | timechart count by clientip useother=f limit=0 | untable _time clineip count` Then I could further stats to count my iterations of "0" values for a threshold. ` <BASE SEARCH> | timechart count by clientip useother=f limit=0 | untable _time clientip count | sort 0 clientip _time | eval no_events=if(count=0,1,0) | streamstats sum(no_events) as consecutive values(no_events) by clientip reset_before=count=1 | stats max(consecutive) as consecutive_missed by clientip | where consecutive_missed>=10 ```Adjust Based on Alert Period, e.g, 24h set to 3; 1hr set to 10; ``` `
... View more