Hi, I'm using a lookup which stores maintenance periods and can be used to exclude events of downtime from my main query. My Lookup looks this way: Numbers StartDateTime EndDateTime 1 2014/01/21 01:00:00 2014/01/22 01:00:00 2 2015/02/21 02:00:00 2014/01/23 01:00:00 The query that I've used is: |base query|[ | inputlookup mainteinance_time | eval end=strptime(End_Date_Time,"%Y/%m/%d %H:%M:%S") , start=strptime(Start_Date_Time,"%Y/%m/%d %H:%M:%S") | eval time="NOT (_time>"+start+" AND _time<"+end+")" | return 2 $time | rex mode=sed field=search "s/OR/AND/g" | return $search This is returning me the correct events. The only problem over here is I'm having the pass the number of rows in the lookup in the "return" function before $time. Is there a way I can recursively do it without having to mention the number? Like calculating the number of rows present and passing the value? How do I build my query on those lines? ... View more

My query is: search[|inputlookup abc | stats count(Numbers) as sum| eval end=strptime(End_Date_Time,"%Y/%m/%d %H:%M:%S") , start=strptime(Start_Date_Time,"%Y/%m/%d %H:%M:%S") | eval time=(_time>"+start+" AND _time<"+end+") | return 2 $time | rex mode=sed field=search "s/OR/AND/g" | return $search] My doubt is how to pass the sum in place of 2? (I'm passing 2 since there are 2 rows) ... View more

Hi, I have these events from where I calculate response time for the particular ping. The events are generated randomly and not at any particular time. So, I want to create an alert in such a way that if the response time is greater than 10 sec for more than 30 mins, it should trigger an alert. How do I go about it? ... View more

|inputlookup |eval duration="xyz"|append[inputlookup |eval duration2="abc"]|eval dur3=duration-duration2| table dur Here, the query is taking value of only the first lookup and not the second one. As a result, I don't get the final table with the value that I require. How to solve this? ... View more