Hi ,
As I understood you have data like;
cnt difference
10 0
15 5
19 4
What I understood is you want to trig if difference<0 but do not trig until difference reach 5.
Here is the new logic:
....|timechart last(Cnt) as CurrentQueueLength span=5m | delta CurrentQueueLength as difference p=3|eval condition1=case(BADCODES<2,"smallerthantwo",BADCODES>5,"biggerthanfive")|eval condition2=if((condition1="smallerthantwo") OR (condition1="biggerthanfive"),1,0)| table _time,BADCODES,condition1,condition2
Now, If condition2="1" on your table, you can rise an alarm.
Cron:*/15 * * * *
Hope it ok
Thanks
Gokhan
... View more